Skip to main content
VulnerabilityPublished Updated

H5MM_memcpy · Hdf5: Negative-size-param

Affects hdf5Source GCVE Database

0
Severity
Medium

Rated by Threat Radar

Data as of 30 Jul 2026, 07:28 UTC

What to do

Affected software

ProductAffectedFixed in
OSS-Fuzzhdf5pkg:generic/hdf5Other threatsAffected
  • >=f527239564fc27a6e666ce734b88e4ab18765efc
  • =1.14.1
  • =hdf5-1_10_10
  • =hdf5-1_14_1
  • =hdf5-1_14_1-2
  • =snapshot
  • =snapshot-1.10
  • =snapshot-1.12
  • =snapshot-1.14
  • =hdf5-1_14_2
  • =hdf5-1_10_11
  • =hdf5-1_14_3-rc1
  • =hdf5-1_14_3
  • =hdf5-1_12_3
  • =hdf5_1.14.4
  • =hdf5-1.14.4.1
  • =hdf5_1.14.4.1
  • =hdf5_1.14.4.2
  • =temp-1.14.4-3
  • =hdf5_1.14.4.3
  • =hdf5_1.14.5
  • =snapshot-1.16
  • =hdf5-1.14.5
  • =hdf5-1.14.6
  • =hdf5_1.14.6
  • =hdff5-1_14-_0
  • =hdff5-1_14_0
  • =final_autotools_develop
  • =2.0.0
  • =hdf5_2.0.0
  • =test-2.0.1-pre1
  • =2.1.0-pre1test
  • =2.1.0
  • =hdf5_2.1.0
  • =2.1.1
  • =2.2.0-rc1
  • =snapshot-2.2.0-rc1
  • =2.2.0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until an official fix is available, users should consider avoiding the affected versions or applying any vendor recommendations once published.

Description

A vulnerability in the hdf5 library involving a negative-size parameter in the H5MM_memcpy function was reported by OSS-Fuzz. The issue causes a crash related to memory copying operations during object link decoding and message iteration. Multiple specific versions of hdf5 are affected, including 1.14.1 and several 2.x pre-release and release versions. No patch or official fix information is currently available.

References

Community reviews

Loading reviews…