A critical stack-based buffer overflow vulnerability in NSF Unidata NetCDF-C could allow a remote attacker to execute arbitrary code on an affected system.

The vulnerability is a stack-based buffer overflow (CWE-121) caused by insufficient length validation when parsing attribute names before copying them to a fixed-length buffer. The attack requires user interaction, specifically the opening of a malicious file or visiting a compromised webpage, and can be triggered by an unauthenticated attacker.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the current user. Given the CVSS score of 7.8, this poses a significant risk to data integrity, confidentiality, and system availability. If the affected software is running with elevated privileges or is integrated into critical data processing pipelines, the impact could lead to full system compromise or lateral movement within the network.

Immediate Action: Since a specific patch version is currently unknown, organizations should restrict the processing of untrusted or externally sourced NetCDF files until the vendor releases a security update.

Proactive Monitoring: Monitor system logs for unusual process creation events or crashes originating from the NetCDF-C library during file parsing operations.

Compensating Controls: Implement strict file validation and sandboxing techniques for any applications utilizing the NetCDF-C library to isolate potential malicious payloads.

Public Exploit Available: No.

Security teams must prioritize the identification of all internal systems utilizing the affected version of the NetCDF-C library. While no patch is currently identified, administrators should monitor the vendor advisories and ZDI-25-1155 closely for the release of a remediation. Until then, treat all ingested NetCDF data as potentially untrusted and implement strict access controls to limit the potential blast radius of an exploit.