Unidata NetCDF-C CVE-2025-14935

Exploitation requires the victim to open an attacker-supplied, malformed NetCDF file (or visit a page that serves one) using an application linked against the vulnerable NetCDF-C library; the trigger is a dimension name whose length exceeds the fixed-size heap buffer in the dimension-name parsing code. Limiting factors: mandatory user interaction (UI:R) - the file must be actively opened; the attack vector is local (AV:L), not a network-exposed service, so there is no unauthenticated remote-service exposure; and code executes only in the context of the current user (S:U, no privilege escalation). Risk is concentrated in workflows that automatically or routinely parse untrusted NetCDF/scientific data files; environments that never process externally sourced NetCDF files are largely unaffected.

This is a CWE-122 heap-based buffer overflow in NSF Unidata NetCDF-C's dimension-name parser, scored CVSS 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vector is LOCAL (AV:L) despite the ZDI title calling it 'Remote Code Execution' - the 'remote' aspect is purely the file-delivery mechanism (victim opens a malicious .nc file or visits a page serving one), so real exploitation always requires user interaction (UI:R). This is a file-format/client-side RCE, not a network-listening service bug; treat it as such. EPSS is low at 0.35% (27th percentile), it is NOT on CISA KEV, and no public exploit code was identified in the provided sources - so there is no evidence of active or imminent widespread exploitation. The high CVSS is driven entirely by the full C:H/I:H/A:H impact of arbitrary code execution, not by ease or likelihood of mass exploitation. Net assessment: a genuine but conditional risk. It matters most for environments that routinely ingest untrusted NetCDF files (research/HPC/data pipelines), where it should be patched promptly; for most general enterprises it is a lower-urgency, patch-on-cycle issue rather than an emergency. Note the apparent tension to verify: title says 'Remote' but CVSS says AV:L - this is consistent once understood as a malicious-file bug, but defenders should not mistake it for an unauthenticated network RCE.

An attacker crafts a malicious NetCDF file containing an overlong dimension name and delivers it via email, a download link, or a shared dataset repository. When a victim opens the file with an application built on NetCDF-C, the oversized name is copied into a fixed-length heap buffer, corrupting heap memory and allowing arbitrary code execution in the context of the current user. No public proof-of-concept was identified in the provided data; exploitation requires the victim to open the file (UI:R) and no special privileges (PR:N).