Log in Start free

Vulnerability · Published Dec 23, 2025 · Assigned by zdi

CVE-2025-14933NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability

High 7.8

In plain English

A high-severity integer overflow in NetCDF-C from NSF Unidata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.8High
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of NC variables. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27266.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12netcdfno fix listedDEBIAN-CVE-2025-14933
Debian:13netcdfno fix listedDEBIAN-CVE-2025-14933
Debian:14netcdf1:4.10.1-1DEBIAN-CVE-2025-14933
Debian:12netcdf-parallelno fix listedDEBIAN-CVE-2025-14933
Debian:13netcdf-parallelno fix listedDEBIAN-CVE-2025-14933
Debian:14netcdf-parallel1:4.10.1-1DEBIAN-CVE-2025-14933
Ubuntu:22.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14933
Ubuntu:24.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14933
Ubuntu:25.10netcdfno fix listedUBUNTU-CVE-2025-14933
Ubuntu:26.04:LTSnetcdfno fix listedUBUNTU-CVE-2025-14933
Ubuntu:26.10netcdfno fix listedUBUNTU-CVE-2025-14933
Ubuntu:22.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14933
Ubuntu:24.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14933
Ubuntu:25.10netcdf-parallelno fix listedUBUNTU-CVE-2025-14933
Ubuntu:26.04:LTSnetcdf-parallelno fix listedUBUNTU-CVE-2025-14933
Ubuntu:26.10netcdf-parallelno fix listedUBUNTU-CVE-2025-14933

Affected products (as reported)

VendorProductVersions
NSF Unidata NetCDF-C dbe0cbb9ff3f706009cf4ee011adf3e58d8a81c1

Weakness: CWE-190 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References