A double free vulnerability was discovered in the HDF5 library. (CVE-2026-17573)
Description
A double free vulnerability exists in the HDF5 library when processing a crafted HDF5 file with an oversized chunk size field via the h5repack tool. This can cause the application to abort due to a double free error. The vulnerability has a CVSS 3.1 score of 5.5, indicating medium severity, and affects multiple specific versions of the HDF5 library as used in various Ubuntu distributions.
CVSS v3.1
Score 5.5medium
Affected software
pkg:deb/ubuntu/hdf5?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/hdf5?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/hdf5?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/hdf5?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/hdf5?arch=source&distro=jammypkg:deb/ubuntu/hdf5?arch=source&distro=noblepkg:deb/ubuntu/hdf5?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17573 describes a double free vulnerability in the HDF5 library. Specifically, when h5repack processes a crafted HDF5 file containing an oversized chunk size field, it may trigger a double free condition causing the application to abort. This vulnerability affects numerous specific versions of the HDF5 library primarily distributed with Ubuntu LTS releases. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges, but user interaction is required. The impact is limited to denial of service (application abort) without confidentiality or integrity loss. There are no known exploits in the wild and no patch information is provided in the source data.
Potential Impact
The vulnerability can cause denial of service by crashing the application (h5repack) due to a double free error. There is no indication of confidentiality or integrity impact. Exploitation requires local access and user interaction, limiting the attack surface. No known active exploits have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted or crafted HDF5 files with h5repack. Monitor vendor channels for updates and apply official fixes once released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-17573
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a870a6facd9273b49b589cf
Added to database: 08/20/2026, 14:08:47 UTC
Last enriched: 08/20/2026, 14:27:27 UTC
Last updated: 10/05/2026, 06:48:14 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.