The HDF Group vulnerabilities
We track 3 vulnerabilities in The HDF Group products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest The HDF Group vulnerabilities
- 7.1 High severity
HDF5: Out-of-bounds Read
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using str
- 8.5 High severity
HDF5: Heap-based Buffer Overflow
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init()
- 8.2 High severity
HDF5: NULL Pointer Dereference
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to th