Hdf5: Heap-buffer-overflow in H5MM_memcpy
A heap-buffer-overflow vulnerability exists in the H5MM_memcpy function of the hdf5 library, as reported by OSS-Fuzz. The issue causes a read overflow during memory copying operations related to cache serialization and image generation. Multiple specific versions of hdf5 are affected. No patch or official fix information is provided in the available data.
AI Analysis
Technical Summary
The hdf5 library contains a heap-buffer-overflow vulnerability in the H5MM_memcpy function, identified through OSS-Fuzz testing. The crash occurs during a read operation in memory copying within the cache serialization and image generation processes (functions H5O__cache_chk_serialize and H5C__generate_image). This vulnerability affects several exact versions of hdf5, including 1.14.1, 2.0.0, 2.1.0-pre1test, 2.1.0, 2.1.1, 2.2.0-rc1, and 2.2.0. There is no CVSS score or vendor advisory available, and no patch or remediation details have been provided.
Potential Impact
The vulnerability causes a heap-buffer-overflow read, which could lead to memory corruption or application crashes when processing data with the affected hdf5 versions. No known exploits in the wild have been reported. The exact impact on confidentiality, integrity, or availability is not detailed in the available information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the affected versions or applying any available updates from the vendor. Monitor official hdf5 project channels for patches addressing this issue.
Hdf5: Heap-buffer-overflow in H5MM_memcpy
Description
A heap-buffer-overflow vulnerability exists in the H5MM_memcpy function of the hdf5 library, as reported by OSS-Fuzz. The issue causes a read overflow during memory copying operations related to cache serialization and image generation. Multiple specific versions of hdf5 are affected. No patch or official fix information is provided in the available data.
Affected software
pkg:generic/hdf5Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The hdf5 library contains a heap-buffer-overflow vulnerability in the H5MM_memcpy function, identified through OSS-Fuzz testing. The crash occurs during a read operation in memory copying within the cache serialization and image generation processes (functions H5O__cache_chk_serialize and H5C__generate_image). This vulnerability affects several exact versions of hdf5, including 1.14.1, 2.0.0, 2.1.0-pre1test, 2.1.0, 2.1.1, 2.2.0-rc1, and 2.2.0. There is no CVSS score or vendor advisory available, and no patch or remediation details have been provided.
Potential Impact
The vulnerability causes a heap-buffer-overflow read, which could lead to memory corruption or application crashes when processing data with the affected hdf5 versions. No known exploits in the wild have been reported. The exact impact on confidentiality, integrity, or availability is not detailed in the available information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the affected versions or applying any available updates from the vendor. Monitor official hdf5 project channels for patches addressing this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- OSV-2023-359
- Osv Schema Version
- 1.4.0
- Ecosystems
- ["OSS-Fuzz"]
Threat ID: 6a6ae55e9c2644c7f89b07f0
Added to database: 07/30/2026, 05:47:10 UTC
Last enriched: 07/30/2026, 07:29:46 UTC
Last updated: 09/07/2026, 17:20:54 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.