LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25050: netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_at...

netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This issue affects GDAL builds with netCDF handling in versions 2.4.2 through 3.0.4. A malformed dataset could trigger stack-based buffer overflows while reading attributes or cleaning up netCDF resources. The sources do not provide CVSS, confirmed exploitation, or business impact evidence.

Executive priority

Prioritize based on whether the business processes untrusted geospatial or scientific data. If exposed pipelines exist, remediate in the next maintenance window; otherwise track through normal dependency hygiene.

Technical view

The CVE describes stack-based buffer overflows in nc4_get_att, reached through nc4_get_att_tc and nc_get_att_text, and in uffd_cleanup, reached from netCDFDataset destructors. The issue is tied to GDAL netCDF processing and referenced by OSS-Fuzz reports and GDAL commits.

Likely exposure

Exposure is most likely where affected GDAL versions parse netCDF or GDAL-supported files supplied by users, partners, research feeds, or automated ingestion pipelines. Systems that do not use GDAL netCDF functionality are less likely exposed.

Exploitation context

The bundle cites OSS-Fuzz findings and GDAL commits, but does not cite active exploitation, public weaponization, KEV listing, or a CVSS score. Treat this as a memory-corruption parsing risk with incomplete severity evidence.

Researcher notes

Evidence is limited to the CVE description, OSS-Fuzz references, and GDAL commits. No affected CPEs, CVSS vector, CWE, exploit status, or fixed release version is provided in the bundle.

Mitigation direction

  • Inventory GDAL versions and identify 2.4.2 through 3.0.4 deployments.
  • Update to a vendor-supported GDAL build containing the referenced fixes.
  • Restrict untrusted netCDF file ingestion until affected components are updated.
  • Run GDAL processing in sandboxed, least-privilege worker environments.
  • Check OS package advisories for backported GDAL fixes.

Validation and detection

  • Confirm installed GDAL versions across servers, containers, and processing images.
  • Map workflows that parse netCDF or externally supplied geospatial datasets.
  • Check package changelogs for the referenced GDAL commits or equivalent backports.
  • Review crash logs for GDAL netCDF attribute or destructor failures.
  • Verify ingestion workers run with limited privileges and isolation.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-25050 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.