CVE-2009-2850: Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arb...

Security readout for executives and security teams

CVE-2009-2850 covers multiple buffer overflows in NASA Common Data Format software. A malicious or malformed CDF file could cause code execution in a program that parses it. The public bundle does not provide a CVSS score, affected version list, or confirmed active exploitation. Exposure is most likely in legacy scientific, space, research, or data-processing systems that use NASA CDF libraries or tools, especially where CDF files arrive from external partners, users, archives, or automated ingestion pipelines. Treat this as a targeted legacy exposure issue. Prioritize environments that process external scientific data files, because compromise could occur through normal file ingestion rather than direct network access. Mitigation focus: Inventory software and pipelines that parse NASA CDF files.; Check NASA CDF vendor release notes for affected and fixed versions.; Update or replace vulnerable CDF components when vendor guidance confirms remediation..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.