Log in Start free

Vulnerability · Published Dec 23, 2025 · Assigned by zdi

CVE-2025-14935NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability

High 7.8

In plain English

A high-severity heap buffer overflow in NetCDF-C from NSF Unidata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.8High
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of dimension names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27168.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12netcdfno fix listedDEBIAN-CVE-2025-14935
Debian:13netcdfno fix listedDEBIAN-CVE-2025-14935
Debian:14netcdf1:4.10.1-1DEBIAN-CVE-2025-14935
Debian:12netcdf-parallelno fix listedDEBIAN-CVE-2025-14935
Debian:13netcdf-parallelno fix listedDEBIAN-CVE-2025-14935
Debian:14netcdf-parallel1:4.10.1-1DEBIAN-CVE-2025-14935
Ubuntu:22.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14935
Ubuntu:24.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14935
Ubuntu:25.10netcdfno fix listedUBUNTU-CVE-2025-14935
Ubuntu:26.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14935
Ubuntu:26.10netcdfno fix listedUBUNTU-CVE-2025-14935
Ubuntu:22.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14935
Ubuntu:24.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14935
Ubuntu:25.10netcdf-parallelno fix listedUBUNTU-CVE-2025-14935
Ubuntu:26.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14935
Ubuntu:26.10netcdf-parallelno fix listedUBUNTU-CVE-2025-14935

Affected products (as reported)

VendorProductVersions
NSF Unidata NetCDF-C dbe0cbb9ff3f706009cf4ee011adf3e58d8a81c1

Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References