CVE-2026-86095
Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
CVE-2026-86095- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-71788
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
EUVD-2026-71788- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mm3m-jp7w-cj3m
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in...
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
GHSA-mm3m-jp7w-cj3m- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
CVE-2026-86095- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
CVE-2026-86095- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-86095
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
DEBIAN-CVE-2026-86095- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-86095
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
UBUNTU-CVE-2026-86095- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-99894 No score
CVE-2026-86095 affecting package netcdf 4.9.0-4
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
- Record
AZL-99894- Updated
- 2026-11-02
OSVSUSE-SU-2026:4249-1 No score
Security update for netcdf
This update for netcdf fixes the following issue:
- CVE-2026-86095: out-of-bounds write in
NC4_HDF5_inq_attname()due to missing length validation when processing a crafted HDF5 file (bsc#1279882).
- Record
SUSE-SU-2026:4249-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netcdfAzure Linux:3 |
through 4.9.0-4 | None known |
netcdfDebian:12 |
All versions, plus listed versions 1:4.10.0-11:4.10.0-1~exp11:4.10.1-11:4.9.0-31:4.9.1-1~exp1 Show 17 moreShow less1:4.9.1~rc1-1~exp11:4.9.1~rc2-1~exp11:4.9.2-11:4.9.2-1~exp11:4.9.2-21:4.9.2-31:4.9.2-3.1~exp11:4.9.2-41:4.9.2-4~exp11:4.9.2-51:4.9.2-61:4.9.2-71:4.9.3-11:4.9.3-1~exp11:4.9.3-1~exp21:4.9.3~rc1-1~exp11:4.9.3~rc2-1~exp1 |
None known |
netcdfDebian:13 |
All versions, plus listed versions 1:4.10.0-11:4.10.0-1~exp11:4.10.1-11:4.9.3-1 |
None known |
netcdfDebian:14 |
All versions, plus listed versions 1:4.10.0-11:4.10.0-1~exp11:4.10.1-11:4.9.3-1 |
None known |
netcdf-parallelDebian:12 |
All versions, plus listed versions 1:4.10.0-11:4.10.1-11:4.10.1-21:4.9.0-11:4.9.0-3 Show 5 moreShow less1:4.9.0-41:4.9.0-51:4.9.0-61:4.9.3-11:4.9.3-2 |
None known |
netcdf-parallelDebian:13 |
All versions, plus listed versions 1:4.10.0-11:4.10.1-11:4.10.1-21:4.9.3-2 |
None known |
netcdf-parallelDebian:14 |
All versions, plus listed versions 1:4.10.0-11:4.10.1-11:4.10.1-21:4.9.3-2 |
None known |
netcdfSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf-openmpi2SUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf-openmpi3SUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
netcdf-openmpi4SUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-mpich-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-mvapich2-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-openmpi2-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-openmpi3-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdf_4_7_4-gnu-openmpi4-hpcSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 4.7.4-150600.15.5.1 | 4.7.4-150600.15.5.1 |
netcdfUbuntu:14.04:LTS |
All versions, plus listed versions 1:4.1.3-6build11:4.1.3-71:4.1.3-7ubuntu2 |
None known |
netcdfUbuntu:16.04:LTS |
All versions, plus listed versions 1:4.4.0~rc2-1build11:4.4.0~rc3-11:4.4.0-11:4.4.0-2 |
None known |
netcdfUbuntu:18.04:LTS |
All versions, plus listed versions 1:4.4.1.1-2ubuntu11:4.5.0-11:4.5.0-21:4.6.0-21:4.6.0-2build1 |
None known |
netcdfUbuntu:20.04:LTS |
All versions, plus listed versions 1:4.6.2-1build11:4.7.3-1 |
None known |
netcdf-parallelUbuntu:20.04:LTS |
All versions, plus listed versions 1:4.6.2-1 |
None known |
netcdfUbuntu:22.04:LTS |
All versions, plus listed versions 1:4.7.4-1build11:4.8.1-1 |
None known |
netcdf-parallelUbuntu:22.04:LTS |
All versions, plus listed versions 1:4.7.4-11:4.8.1-2 |
None known |
netcdfUbuntu:24.04:LTS |
All versions, plus listed versions 1:4.9.2-2ubuntu11:4.9.2-3ubuntu11:4.9.2-5ubuntu31:4.9.2-5ubuntu4 |
None known |
netcdf-parallelUbuntu:24.04:LTS |
All versions, plus listed versions 1:4.9.0-1ubuntu11:4.9.0-1ubuntu31:4.9.0-1ubuntu4 |
None known |
netcdfUbuntu:26.10 |
All versions, plus listed versions 1:4.9.3-1build21:4.10.0-11:4.10.1-11:4.10.1-1build1 |
None known |
netcdf-parallelUbuntu:26.10 |
All versions, plus listed versions 1:4.9.3-2build21:4.10.0-11:4.10.1-11:4.10.1-21:4.10.1-2build1 |
None known |
netcdfUbuntu:26.04:LTS |
All versions, plus listed versions 1:4.9.3-1build11:4.9.3-1build2 |
None known |
netcdf-parallelUbuntu:26.04:LTS |
All versions, plus listed versions 1:4.9.3-2build11:4.9.3-2build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-86095 is a high vulnerability (CVSS 8.5) in Nsf Unidata Netcdf-c, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in netcdf 4.7.4-150600.15.5.1.
References
github.com/Unidata/netcdf-c
vulncheck.com/advisories/unidata-netcdf-c-through-4.10.1-out-of-bounds-write-via-oversized-hdf5-attribute-name
nvd.nist.gov/vuln/detail/CVE-2026-86095