A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly… (CVE-2026-106547)

The vulnerability is a heap-based buffer overflow in the H5VM_array_fill() function of HDF5 prior to version 2.2.0. Specifically, when unallocated chunks of a dataset are read, the function H5D__fill_init() fills the fill-value buffer using datatype and dataspace metadata from the file. If this metadata is inconsistent with the buffer's allocated size, the function writes past the end of the buffer, leading to a heap overflow. Since the attacker controls the fill value stored in the file, they can influence the data written, potentially causing an application crash or arbitrary code execution.

Exploitation of this vulnerability can lead to application crashes and possibly arbitrary code execution. The attacker can craft malicious HDF5 files that trigger the heap overflow when processed by vulnerable versions of the software. This can compromise the stability and security of applications using the affected HDF5 library versions.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid processing untrusted or unverified HDF5 files to mitigate risk.