NetCDF-C
CVE-2025-14934
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious NetCDF file to victim
-
ExploitUser opens file in NetCDF-C app
-
ExecutionOverlong variable name overflows stack buffer
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious NetCDF file (or visit a page that supplies one) using an application built on the NSF Unidata NetCDF-C library; the specific trigger is a NetCDF variable name whose length exceeds the fixed-length stack buffer during name parsing. Limiting factors: this is a LOCAL vector (AV:L) requiring user interaction (UI:R) - there is no autonomous network-remote or server-side path, no authentication is needed (PR:N), and impact is confined to the current user's context (S:U). Realistic risk is therefore gated by social engineering and by whether the victim's workflow involves opening untrusted NetCDF files. |
| Impact | This is a genuinely high-severity code-execution flaw (CVSS 7.8) but NOT an urgent, widespread-exploitation priority based on current signals. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R) describes a client-side, file-parsing bug: although the ZDI advisory title says 'Remote Code Execution,' the attack vector is LOCAL and requires user interaction (opening a malicious NetCDF file or visiting a malicious page), so it is not network-remote in the unauthenticated-server sense. There is a notable labeling tension worth flagging: the title and description say 'remote attackers,' yet the CVSS AV:L and UI:R correctly reflect that the victim must open attacker-supplied content - this is the standard ZDI client-side classification, not a server-side remote flaw. EPSS is low (0.35%, 27th percentile), there is NO CISA KEV listing, and NO public exploit has been identified, so exploitation status is: no public exploit identified at time of analysis. The low EPSS is consistent with the local/user-interaction requirement, which materially limits mass exploitation. Net: remediate on a normal patch cadence; it is a legitimate memory-corruption RCE in a widely embedded scientific library, but not a drop-everything emergency absent evidence of active exploitation or a public POC. |
| Exploit ScenarioDerived | An attacker crafts a malicious NetCDF file containing an overlong variable name and delivers it to a victim (via email, download, or a web page) who opens it in an application built on NetCDF-C. Parsing the oversized variable name overflows a fixed-length stack buffer, letting the attacker execute arbitrary code in the context of the current user. No public proof-of-concept has been identified, and successful exploitation depends on the victim opening the attacker-supplied file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
A stack-based buffer overflow in NSF Unidata NetCDF-C occurs when parsing a variable name longer than the library's fixed-length stack buffer, allowing arbitrary code execution in the context of the user running the affected application. The flaw is rated CVSS 7.8 but requires the victim to open a malicious NetCDF file (or visit a page that delivers one) in an application built on the library - the vector is local with mandatory user interaction (AV:L/AC:L/PR:N/UI:R/S:U), so there is no server-side or autonomous network path, and no authentication is required. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at roughly 0.35% (27th percentile), making this a genuine code-execution risk gated by social engineering rather than an urgent widespread-threat priority.
RemediationAI
Primary fix: upgrade to the NetCDF-C release that contains upstream validation of variable-name length (check Unidata's release notes and the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1152/ for the exact fixed version, since no specific fix version is enumerated in the available data); because the library is commonly bundled, also rebuild or update every downstream application and language binding (NCO, CDO, netCDF4 Python wheels, etc.) that embeds the vulnerable parser - vendor-released patch availability for those wrappers must be verified independently. If patching must be deferred, compensating controls with trade-offs include: avoid opening untrusted or unsolicited NetCDF files (breaks legitimate data-exchange workflows and relies on user discipline); sandboxing file-conversion and analysis jobs (containers with seccomp/no-new-privileges, or browser-based viewers) so a successful overflow cannot reach the host, at the cost of some performance and I/O friction; running parsing workloads under a low-privilege account with restricted filesystem and network access to limit post-exploitation blast radius; enabling compiler and OS hardening (stack protector, FORTIFY_SOURCE, ASLR, non-executable stack) on custom builds to raise exploitation difficulty without eliminating the flaw; and scanning or normalizing inbound NetCDF headers to reject absurdly long variable names, though such filters are easily bypassed and should not replace the patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetCDF-C is the reference C implementation of the NetCDF self-describing, machine-independent data format widely used across climate, weather, oceanographic, and scientific computing pipelines; CDO, NCO, Python netCDF4 bindings, and many visualization tools link against it. The defect is CWE-121 (stack-based buffer overflow) in the variable-name parsing path: user-supplied name data from a crafted file is copied into a fixed-length stack buffer without validating its length first, so an oversized variable name overwrites adjacent stack memory. Classic control-flow hijacking (saved return address, function pointers, or stack canaries bypassed depending on build hardening) can yield arbitrary code execution under the privileges of the process opening the file. The ZDI advisory (ZDI-25-1152, ZDI-CAN-27267) credits Trend Micro's Zero Day Initiative reporting; the CPE string cpe:2.3:a:unidata:netcdf identifies the unidata/netcdf product family, and the CVE does not pin a specific release version range, so all NetCDF-C builds that have not incorporated an upstream fix should be presumed exposed.
Know when Netcdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing bug triggered by opening attacker-supplied content, so AV:L and UI:R; no privileges needed (PR:N); code execution as current user yields full C/I/A:H with unchanged scope.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of variable names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27267.
Executive ViewAI
NSF Unidata's NetCDF-C library, embedded in a broad range of scientific, engineering, and analytics tools, contains a high-severity stack-based buffer overflow that allows code execution on the workstation of any user who opens a crafted data file. Exposure is concentrated in research, engineering, and data-science teams that routinely ingest NetCDF datasets from external collaborators, and with no vendor patch yet released those endpoints remain exposed until interim controls are in place. Leadership should treat this as a contained but persistent endpoint risk driven by user file-opening behavior rather than a network-facing threat.
No vendor-released patch identified at time of analysis. Interim mitigations: block untrusted .nc/.netcdf/.cdf files at email and web gateways and enforce file-provenance checks; run NetCDF-consuming tools with least privilege and OS sandboxing; disable automatic file-association handlers so files are not opened without explicit user action; process untrusted datasets in isolated or disposable environments; monitor endpoints for anomalous child-process behavior spawned by NetCDF-based applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Integer overflow in NSF Unidata NetCDF-C during parsing of NC variable definitions can lead to arbitrary code execution
Code execution in NSF Unidata NetCDF-C can be triggered when a user opens or processes a crafted NetCDF file containing
Heap-based buffer overflow in NSF Unidata NetCDF-C's dimension-name parsing allows code execution in the context of the
Stack-based buffer overflow in NSF Unidata NetCDF-C's time-unit parsing routine allows arbitrary code execution at the p
GitHub PoC
Exploit-DB