Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of… (CVE-2026-17572)

CVE-2026-17572 describes a heap-based buffer overflow in the SOHM list-index deserialization code within HDF5 versions through 2.1.1. The vulnerability occurs when a crafted HDF5 file contains a shared-message list index with a num_messages count that exceeds the list_max value. This triggers out-of-bounds heap reads and writes in the functions H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum, resulting in a denial of service via application crash. The issue affects all platforms running vulnerable versions of HDF5. The CVSS 3.1 base score is 5.5, indicating a medium severity with local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, but high availability impact.

Successful exploitation causes a denial of service by crashing the application processing the malicious HDF5 file. There is no reported impact on confidentiality or integrity. The vulnerability requires local access and user interaction to trigger the crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or unauthenticated HDF5 files that could exploit this vulnerability.