Hdfgroup vulnerabilities
141 vulnerabilities
Known vulnerabilities in Hdfgroup products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Hdf5141 vulnerabilities
RoutineCVE-2026-120758the hdf group · hdf5 +1 moreNULL Pointer Dereference in H5HL_unprotect via Corrupted FileHDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.CVSS5.5MediumRoutineCVE-2026-120757the hdf group · hdf5 +1 moreHeap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverseHDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.CVSS7.1HighRoutineCVE-2026-120756the hdf group · hdf5 +1 moreHeap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserializeHDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.CVSS6.1MediumRoutineCVE-2026-120755the hdf group · szip filter +1 moreInteger Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip FilterHDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.CVSS5.5MediumRoutineCVE-2026-120754the hdf group · scale-offset filter +1 moreUninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset FilterHDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.CVSS3.3LowRoutineCVE-2026-17574the hdf group · hdf5 +3 moreNULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type TagHDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.CVSS5.5MediumEPSS0.15%RoutineCVE-2026-17573the hdf group · hdf5 +3 moreDouble Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size FieldA double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.CVSS5.5MediumEPSS0.15%RoutineCVE-2026-17572the hdf group · hdf5 +3 moreHDF5 SOHM List Index Heap Buffer OverflowHeap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.CVSS5.5MediumEPSS0.14%RoutineCVE-2026-26199hdfgroup · hdf5 +2 moreBuffer underflow in `H5Iget_name `/`H5G_get_name` if size is zeroHDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.CVSS6.5MediumEPSS0.35%RoutineCVE-2026-26197hdfgroup · hdf5 +2 moreArray full size, element count, and element size are not checked to make sure they match in H5Odtype.cHDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.CVSS7.5HighEPSS0.37%RoutineCVE-2026-29043hdfgroup · hdf5 +2 moreHDF5 H5T__ref_mem_setnull Heap Buffer OverflowHDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.CVSS5.5MediumEPSS0.21%PrioritiseCVE-2026-34734hdfgroup · hdf5 +2 moreHDF5: H5T__conv_struct Use After FreeHDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.CVSS7.8HighEPSS0.19%PrioritiseCVE-2026-26200hdfgroup · hdf5 +2 moreHDF5 Affected by H5T__conv_struct_opt Heap Buffer OverflowHDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.CVSS7.8HighEPSS0.42%RoutineCVE-2025-7069hdfgroup · hdf5 +2 moreHDF5 H5FSsection.c H5FS__sect_link_size heap-based overflowA vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.CVSS5.5MediumEPSS0.27%RoutineCVE-2025-7068hdfgroup · hdf5 +2 moreHDF5 H5FL.c H5FL__malloc memory leakA vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.CVSS5.5MediumEPSS0.24%RoutineCVE-2025-7067hdfgroup · hdf5 +2 moreHDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflowA vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.CVSS5.5MediumEPSS0.27%RoutineCVE-2025-6858hdfgroup · hdf5 +2 moreHDF5 H5Centry.c H5C__flush_single_entry null pointer dereferenceA vulnerability was found in HDF5 1.14.6 and classified as problematic. Affected by this issue is the function H5C__flush_single_entry of the file src/H5Centry.c. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.CVSS5.5MediumEPSS0.25%RoutineCVE-2025-6857hdfgroup · hdf5 +2 moreHDF5 H5Gnode.c H5G__node_cmp3 stack-based overflowA vulnerability has been found in HDF5 1.14.6 and classified as problematic. Affected by this vulnerability is the function H5G__node_cmp3 of the file src/H5Gnode.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.CVSS7.8HighEPSS0.29%RoutineCVE-2025-6856hdfgroup · hdf5 +2 moreHDF5 H5FL.c H5FL__reg_gc_list use after freeA vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FL__reg_gc_list of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.CVSS7.8HighEPSS0.25%RoutineCVE-2025-6818hdfgroup · hdf5 +2 moreHDF5 H5Ochunk.c H5O__chunk_protect heap-based overflowA vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.CVSS7.8HighEPSS0.31%