Executive brief
Unidata netcdf-c is a data access library used by scientific applications to read and write HDF5 and netCDF files. A memory corruption flaw in attribute name processing allows attackers to craft malicious HDF5 files that crash applications or potentially execute arbitrary code when the library enumerates file attributes.
Technical details
The vulnerability is an out-of-bounds write (buffer overflow) in the NC4_HDF5_inq_attname() function in libhdf5/hdf5attr.c. The function copies HDF5 attribute names into a fixed 256-byte stack buffer without validating the length of the source data. An attacker can craft an HDF5 file with attribute names longer than 256 bytes to overflow the buffer, causing heap corruption, denial of service, or potentially code execution. The attack requires opening a malicious HDF5 file and triggering attribute name enumeration; no special authentication or network access is required. No patch status is currently indicated in the advisory.
Affected products
- Unidata netcdf-c through 4.10.1
Timeline
- 2026-09-04: disclosed