Out-of-bounds Write Vulnerability in Unidata NetCDF Product

CVE-2026-86095

What is CVE-2026-86095?

An out-of-bounds write vulnerability exists in Unidata's netcdf-c up to version 4.10.1, specifically within the NC4_HDF5_inq_attname() function. This flaw allows for the copying of oversized HDF5 attribute names into a fixed 256-byte buffer without appropriate length validation. Consequently, attackers can exploit this vulnerability by creating HDF5 files containing excessively long attribute names, leading to potential memory corruption and application crashes during the enumeration of these attribute names.

References