CVE-2026-106547: CWE-122 Heap-based buffer overflow in The HDF Group HDF5

The vulnerability exists in the H5VM_array_fill() function within src/H5VM.c of the HDF5 library versions >=1.10.0 and <2.2.0. When a dataset's unallocated chunks are read, the H5D__fill_init() function fills the fill-value buffer using datatype and dataspace metadata from the file. If this metadata is inconsistent with the buffer's allocated size, the function writes past the end of the buffer, resulting in a heap-based buffer overflow. An attacker can control the content written by manipulating the fill value stored in the crafted HDF5 file, potentially causing a crash or arbitrary code execution.

This vulnerability allows a remote attacker to cause an application crash or possibly execute arbitrary code by supplying a specially crafted HDF5 file. The impact includes denial of service and potential remote code execution with user interaction, given the CVSS vector indicates local attack vector with low complexity and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor The HDF Group's advisories for updates and avoid processing untrusted HDF5 files until a fix is available.