Is CVE-2026-86095 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86095 being exploited in the wild.

How severe is CVE-2026-86095?

High severity, with a CVSS score of 7.8, published 4 September 2026.

Which products and versions are affected?

Unidata Netcdf-C through 4.10.1.

Is there a fix for CVE-2026-86095?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86095 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-86095?

Check whether you run Unidata Netcdf-C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86095: Unidata netcdf-c out-of-bounds write in attribute name handling

CVE-2026-86095 · Severity: high · CVSS 7.8 · Published 2026-09-04

Unidata netcdf-c is a data access library used by scientific applications to read and write HDF5 and netCDF files. A memory corruption flaw in attribute name processing allows attackers to craft malicious HDF5 files that crash applications or potentially execute arbitrary code when the library enumerates file attributes.

Vendors: Unidata.

Quick answers

Is CVE-2026-86095 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86095 being exploited in the wild.
How severe is CVE-2026-86095?: High severity, with a CVSS score of 7.8, published 4 September 2026.
Which products and versions are affected?: Unidata Netcdf-C through 4.10.1.
Is there a fix for CVE-2026-86095?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86095 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-86095?: Check whether you run Unidata Netcdf-C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds write (buffer overflow) in the NC4_HDF5_inq_attname() function in libhdf5/hdf5attr.c. The function copies HDF5 attribute names into a fixed 256-byte stack buffer without validating the length of the source data. An attacker can craft an HDF5 file with attribute names longer than 256 bytes to overflow the buffer, causing heap corruption, denial of service, or potentially code execution. The attack requires opening a malicious HDF5 file and triggering attribute name enumeration; no special authentication or network access is required. No patch status is currently indicated in the advisory.

Affected products

Unidata netcdf-c through 4.10.1

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.