libnetcdf-4.9.3-nompi_h81b047f_102.conda: 1 vulnerabilities (highest severity is: 7.8)

[mend-bolt-for-github]

Vulnerable Library - libnetcdf-4.9.3-nompi_h81b047f_102.conda

Libraries and data formats that support array-oriented scientific data

Library home page: https://api.anaconda.org/download/conda-forge/libnetcdf/4.9.3/linux-64/libnetcdf-4.9.3-nompi_h81b047f_102.conda

Sample Path to Dependency File: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/libnetcdf-4.9.3-nompi_h81b047f_102.conda

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (libnetcdf version)	Remediation Possible**
CVE-2026-86095	High	7.8	libnetcdf-4.9.3-nompi_h81b047f_102.conda	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-86095

Vulnerable Library - libnetcdf-4.9.3-nompi_h81b047f_102.conda

Libraries and data formats that support array-oriented scientific data

Library home page: https://api.anaconda.org/download/conda-forge/libnetcdf/4.9.3/linux-64/libnetcdf-4.9.3-nompi_h81b047f_102.conda

Sample Path to Dependency File: /environment.yml

Path to vulnerable library: /home/wss-scanner/miniconda3/pkgs/libnetcdf-4.9.3-nompi_h81b047f_102.conda

Dependency Hierarchy:

• ❌ libnetcdf-4.9.3-nompi_h81b047f_102.conda (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

Publish Date: 2026-09-04

URL: CVE-2026-86095

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here