Threat database

CVE-2026-106547 is a heap-based buffer overflow vulnerability in the HDF5 library before version 2.2.0. It occurs in the H5VM_array_fill() function when reading unallocated chunks of a dataset with inconsistent metadata, allowing writes beyond the allocated buffer size. This flaw can cause application crashes and potentially arbitrary code execution when processing crafted HDF5 files.

CVE-2026-19029 is a heap-based buffer over-read vulnerability in the HDF5 library (The HDF Group) affecting versions prior to 2.2.0. The flaw exists in the H5Z__filter_scaleoffset() function, where an attacker can craft a malicious HDF5 file that triggers a denial of service via application crash. This occurs because the decoder copies data from a compressed chunk without verifying the chunk size when certain filter parameters are attacker-controlled.

CVE-2026-92627 is a heap-use-after-free vulnerability in the HDF5 library before version 1.14.2. It occurs during the conversion of compound datatypes containing floating-point members when reading datasets. An attacker can craft a malicious HDF5 file that triggers this vulnerability, potentially causing application crashes or memory corruption. The vulnerability has a medium severity score of 4.6 and affects local attack vectors with low complexity and no privileges required but requires user interaction.

H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.

H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

A divide-by-zero vulnerability exists in HDF5 through version 2.3.0 due to improper validation of chunk-layout dimensionality against dataspace rank when opening an existing dataset. This can cause a denial of service via application crash when processing a crafted HDF5 file.

A NULL pointer dereference vulnerability exists in HDF5 before version 2.1.1 in the H5Pget_fill_value function. This flaw allows denial of service when processing a dataset with a version 1 or 2 fill value message that has the "defined" flag set and a negative size field, leading to a NULL datatype dereference.

CVE-2026-19023 is a medium severity vulnerability in The HDF Group's HDF5 software, affecting versions before 2.1.1. It involves an untrusted pointer dereference in the h5dump tool's render_bin_output function. This flaw can cause a denial of service when processing variable-length string datasets with multiple elements in binary dump mode, due to corrupted stride calculations leading to misaligned pointer dereferences.

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.