NetCDF-C
CVE-2025-14932
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious NetCDF file to victim
-
DeliveryUser opens file in NetCDF-C app
-
ExploitOverflow fixed stack buffer in time-unit parser
-
ExecutionHijack control flow and execute code
-
ImpactRun arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or process an attacker-controlled NetCDF file whose time-unit field contains data exceeding the fixed-length stack buffer, parsed by NetCDF-C's time-unit parsing code path. The required UI:R (user must open the malicious file or visit a page that serves it) and the local attack vector (AV:L) are the primary limiting factors - there is no network-service exposure and no automatic/unauthenticated remote trigger. No special privileges are needed (PR:N) and no non-default configuration is indicated, so any build of NetCDF-C that parses untrusted files is affected; code runs only at the privilege of the current user (S:U). |
| Impact | This is a moderate-priority issue whose signals are broadly consistent and point AWAY from mass exploitation. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R) describes a LOCAL attack vector requiring user interaction, not a truly remote network-facing flaw: despite the ZDI title and the phrase 'remote attackers,' exploitation requires the victim to open a malicious NetCDF file or visit a page that delivers one, which is why the vector is AV:L/UI:R rather than AV:N. Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H) with code execution in the context of the current user (S:U - no privilege escalation beyond the running process). EPSS is low at 0.35% (27th percentile), which aligns with the UI-dependent local vector and the absence of a listed public exploit. KEV status is NO (not CISA-listed) and no POC is indicated in the provided data, so there is no evidence of active exploitation. NOTE THE APPARENT CONFLICT: the description uses 'remote attackers' while the CVSS vector is AV:L - this is the standard ZDI file-parsing categorization (attacker is remote but delivery requires local file handling); defenders should treat this as a client-side/file-parsing bug, not a network-reachable service flaw. Net: a legitimately dangerous memory-corruption RCE, but real-world risk is gated by user interaction and is well below that of a wormable or network-exploitable vulnerability. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker crafts a malformed NetCDF file containing an overly long time-unit string and distributes it via email, a shared dataset repository, or a malicious web page. When a researcher or an application using NetCDF-C parses the file's time units, the oversized data overflows a fixed-length stack buffer, letting the attacker execute arbitrary code as the current user. No public exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Stack-based buffer overflow in NSF Unidata NetCDF-C's time-unit parsing routine allows arbitrary code execution at the privilege of the current user when a victim opens a crafted NetCDF file. Exploitation is gated by user interaction (UI:R) and a local attack vector (AV:L): the attacker must deliver a malicious file or page that the target then parses, there is no network-service exposure and no automatic trigger, though no privileges are required (PR:N) and no non-default configuration is indicated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.35%, 27th percentile), consistent with a moderate-priority issue rather than a mass-exploitation threat; the ZDI advisory ZDI-25-1153 (ZDI-CAN-27273) documents the disclosure.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with confirming whether an upstream NetCDF-C fix has since been tagged and, if so, rebuilding or upgrading to that release - check the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1153/ and the Unidata NetCDF-C release notes rather than assuming a version number. Until a fix is available, the highest-value control is input provenance: refuse to open NetCDF files from untrusted sources and quarantine or pre-screen them, since the flaw only triggers when a malicious file is parsed (UI:R is the primary limiting factor). Where untrusted files must be handled, run the parsing step in a sandboxed or low-privilege worker (container with seccomp/AppArmor, dedicated unprivileged user, no network egress and no access to credentials) so a successful overflow yields nothing of value - the trade-off is operational overhead and possible breakage of jobs that need filesystem or network access. Build-level hardening helps but does not remove the bug: compile NetCDF-C and its units-parsing dependency with -fstack-protector-strong, _FORTIFY_SOURCE and full ASLR/PIE, accepting that these raise exploitation difficulty rather than eliminating the overflow. If the time-unit conversion path is not needed by a given deployment, disabling or stubbing that feature reduces attack surface, at the cost of losing time-coordinate interpretation for legitimate datasets.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetCDF-C is the reference C implementation of the NetCDF self-describing array data format used widely in climate, weather, oceanographic and scientific data pipelines; its time-unit handling (the 'units' attribute such as 'days since 1990-01-01', typically delegated to the UDUNITS-style conversion code path) parses strings supplied inside the file itself. CWE-121 (stack-based buffer overflow) describes the root cause precisely: the parser copies a user-controlled time-unit string into a fixed-length stack buffer without validating its length first, so an overlong field overwrites adjacent stack memory including saved return addresses and can redirect control flow. Because the data is embedded in the file rather than delivered over a socket, the CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - the attacker needs the victim to load the file but gains high confidentiality and integrity impact within the user's own security scope. Note that the flaw may sit in the bundled/underlying units-parsing library rather than the container format handling itself, so any application, service or batch ingest job that calls into NetCDF-C on untrusted inputs is in scope.
Know when Netcdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by the victim, so AV:L and UI:R; no privileges needed (PR:N); straightforward overflow gives AC:L and full C:H/I:H/A:H code execution in the user context.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of time units. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27273.
Executive ViewAI
CVE-2025-14932 is a high-severity stack-based buffer overflow in NSF Unidata NetCDF-C's time-unit parsing routine that can permit arbitrary code execution at the current user's privilege when a victim opens a crafted NetCDF file. Because exploitation requires local file delivery and user interaction, with no public exploit identified at time of analysis, the immediate organizational risk is concentrated among users and pipelines that process untrusted NetCDF datasets rather than broad network-facing exposure. Leadership should care because successful exploitation could compromise endpoint integrity and data-processing workflows under the victim's account.
No vendor-released patch identified at time of analysis. Restrict processing of NetCDF files to trusted sources, sandbox or containerize NetCDF parsers, run parsing under least-privilege accounts, validate file origins, and monitor vendor advisory ZDI-25-1153 for a fixed release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Integer overflow in NSF Unidata NetCDF-C during parsing of NC variable definitions can lead to arbitrary code execution
Code execution in NSF Unidata NetCDF-C can be triggered when a user opens or processes a crafted NetCDF file containing
Heap-based buffer overflow in NSF Unidata NetCDF-C's dimension-name parsing allows code execution in the context of the
A stack-based buffer overflow in NSF Unidata NetCDF-C occurs when parsing a variable name longer than the library's fixe
GitHub PoC
Exploit-DB