The netcdf-c library contains a buffer overflow in the NC4_HDF5_inq_attname function. When the function reads an HDF5 attribute name, it copies the name into a fixed 256-byte buffer without validating the length. A crafted HDF5 file with an attribute name longer than 256 bytes will overflow the buffer, corrupting adjacent memory and causing the application to crash whenever it enumerates attributes. This overflow corrupts memory and can cause the application to crash when attributes are enumerated. No further exploitation is described in the available data.

All versions of Unidata netcdf-c up to and including 4.10.1 are affected. The product, netcdf-c, is widely used by scientific and geospatial software that reads or writes HDF5 files.

The CVSS score of 8.5 highlights high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying a malicious HDF5 file to any application that links against the vulnerable library to enumerate attribute names. Based on the description, the attack vector may be local or remote depending on whether the target application processes user-supplied files; successful exploitation results in memory corruption and crashes.