HDF5 vulnerabilities

3 known vulnerabilities in HDF5 from The HDF Group. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  HDF5: Out-of-bounds Read

  CVE-2026-120757Nov 3, 2026The HDF Group

  HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using str

• 8.5 High severity

  HDF5: Heap-based Buffer Overflow

  CVE-2026-106547Oct 6, 2026The HDF Group

  A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init()

• 8.2 High severity

  HDF5: NULL Pointer Dereference

  CVE-2026-19024Aug 5, 2026The HDF Group

  NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to th