NetCDF-C CVE-2025-14936

Exploitation requires the victim to open or process an attacker-crafted NetCDF file (or visit a page that triggers such processing) using an application built on NetCDF-C; the attacker must supply a file whose attribute name exceeds the fixed-length stack buffer. Key LIMITING factors confirmed by the CVSS vector: the vector is local (AV:L) - there is no listening network service to attack directly - and user interaction (UI:R) is mandatory, so the victim must be induced to open the malicious file. No special NetCDF configuration is cited as required; the flaw is in core attribute-name parsing. Code executes only with the privileges of the user running the parser, limiting impact on properly least-privileged accounts. Exact affected/fixed versions are not confirmed from the available data.

This is a stack-based buffer overflow (CWE-121) in NetCDF-C's attribute-name parsing, carrying a CVSS 3.0 base of 7.8 (HIGH). Critically, the vector is AV:L/UI:R, NOT network-exploitable: despite the title calling this a 'Remote Code Execution' flaw and the description saying 'remote attackers,' the CVSS vector confirms exploitation requires local processing of attacker-controlled data (opening a malicious file or loading a malicious dataset) plus victim interaction. This is the standard ZDI framing for client-side file-parsing bugs and should not be read as a server-side remote exploit. Exploitation signals are modest: EPSS is low at 0.35% (27th percentile), there is no CISA KEV listing, and no public exploit code is referenced - only the ZDI advisory. No SSVC decision data was provided. Net assessment: this is a genuine code-execution bug worth patching on systems that ingest untrusted NetCDF files, but it is NOT an urgent internet-facing emergency - the local vector, required user interaction, and low EPSS all point to opportunistic or targeted file-delivery risk rather than mass exploitation. Prioritize for workstations and pipelines that parse third-party scientific data; deprioritize relative to true unauthenticated network RCEs.

An attacker crafts a malicious NetCDF file containing an overly long attribute name and delivers it to a victim (e.g., via email, a shared dataset repository, or a download link). When the victim opens or processes the file with a NetCDF-C-based application, the oversized attribute name overflows a fixed-length stack buffer, enabling arbitrary code execution in the context of the current user. No public proof-of-concept is referenced at time of analysis, and exploitation hinges on the victim choosing to open the attacker-supplied file.