NetCDF-C CVE-2025-14933

Exploitation requires the victim to open or process an attacker-crafted NetCDF file (or visit a page that causes such a file to be parsed) using an application built on the NetCDF-C library; the malicious file must contain NC variable definitions whose values trigger the integer overflow during buffer-size calculation. Limiting factors: AV:L and UI:R mean this is NOT remotely exploitable against a service - it needs user interaction and local file processing. Code runs only with the privileges of the user who opened the file (S:U, no privilege escalation). There is no indication a non-default configuration is required; any NetCDF-C-based reader that parses untrusted files is exposed.

This is a genuine high-severity local code-execution flaw (CVSS 7.8, CWE-190 integer overflow before buffer allocation) but the real-world urgency signals are modest. Critically, the CVSS vector is AV:L (local attack vector) with UI:R, which is consistent with the ZDI description's file-parsing scenario - the 'remote attackers' wording in the title refers to delivery of a malicious file/page, not a network-reachable service, so this is NOT remotely triggerable without victim interaction. EPSS is low at 0.36% (28th percentile), there is no CISA KEV listing, and no public exploit has been identified, so this is not a widespread-exploitation emergency. SSVC framing: exploitation=none observed, automatable=no (requires a user to open a crafted file), technical impact=total (C:H/I:H/A:H). Net: a credible client-side RCE worth patching in environments that process untrusted NetCDF files (scientific/climate data pipelines), but not a drop-everything internet-facing crisis. Note the apparent tension between the 'Remote Code Execution' title and AV:L - resolve by treating it as file-/content-delivered local execution, confirmed by the ZDI advisory language.

An attacker crafts a malicious NetCDF file with manipulated NC variable metadata that triggers an integer overflow during buffer-size calculation, then delivers it to a victim via a website download or email attachment. When the victim opens the file in an application linked against NetCDF-C, the undersized buffer is overflowed and attacker-controlled code executes in the context of that user. No public exploit code has been identified, though the flaw was reported with full technical detail by Trend Micro ZDI (ZDI-CAN-27266).