CVE-2026-26200 is a heap-based buffer overflow vulnerability (CWE-122) in HDFGroup's hdf5 software. Versions prior to 1.14.4-2 are affected. The flaw occurs when an attacker controls an h5 file parsed by hdf5, leading to a write-based heap buffer overflow. This can cause denial-of-service and may allow further impacts such as remote code execution depending on exploitability on modern OSes. The issue is addressed by the release of version 1.14.4-2. The CVSS v3.1 score is 7.8 (high severity) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Red Hat has published an advisory confirming the fix.

Successful exploitation can lead to denial-of-service and potentially remote code execution, depending on the practical exploitability of the heap overflow on modern operating systems. Confidentiality, integrity, and availability impacts are all rated high per the CVSS vector. No known exploits are currently reported in the wild.

Upgrade affected installations of hdf5 to version 1.14.4-2 or later, which contains the official fix for this vulnerability. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-26200 for detailed remediation guidance. No alternative mitigations are indicated.