🚨 CVE-2026-86095
Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.
🎖@cveNotify
GitHub
GitHub - Unidata/netcdf-c: Official GitHub repository for netCDF-C libraries and utilities.
Official GitHub repository for netCDF-C libraries and utilities. - Unidata/netcdf-c
September 4, 2026 19
