CVE-2026-106547 in HDF5
Summary
by MITRE • 10/07/2026
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as a heap-based buffer overflow within the HDF5 library affects versions prior to 2.2.0 and resides specifically in the H5VM_array_fill function located in src/H5VM.c. This flaw allows remote attackers to cause application crashes or potentially execute arbitrary code by providing a specially crafted HDF5 file. The root cause of this vulnerability lies in an inconsistency between the metadata describing the dataset's datatype and dataspace and the actual size allocated for the fill-value buffer during read operations involving unallocated chunks. When H5D__fill_init is invoked to populate the fill-value buffer, it relies on information extracted from the HDF5 file's internal structure. If this metadata does not accurately reflect the memory constraints or if there is a miscalculation in determining the required buffer size, the subsequent write operation exceeds the boundaries of the allocated heap memory.
From a technical perspective, this issue represents a classic out-of-bounds write scenario where an attacker can control the content being written into the overflowed region through the fill value stored within the malicious HDF5 file. By manipulating these values, an adversary gains significant influence over what data is placed in adjacent memory locations on the heap. This capability transforms a simple denial of service condition, characterized by application crashes due to memory corruption, into a potential remote code execution vector. The ability to overwrite heap metadata or function pointers enables attackers to hijack control flow and execute arbitrary commands with the privileges of the compromised process.
In terms of industry standards classification, this vulnerability aligns closely with CWE-122, which denotes a heap-based buffer overflow. This category encompasses errors where an application writes data beyond the bounds of a dynamically allocated block of memory on the heap. Furthermore, from a tactical standpoint related to cyber attack frameworks such as MITRE ATT&CK, this flaw facilitates initial access and execution phases by allowing attackers to leverage file parsing weaknesses for code injection. The exploitation path typically involves tricking a victim into opening or processing a maliciously constructed HDF5 dataset, thereby triggering the flawed memory handling routine within the library.
The operational impact of this vulnerability is severe due to its remote exploitability via standard data ingestion workflows. Applications that process scientific data, particularly those in research and engineering sectors relying on HDF5 for large-scale datasets, are at risk if they do not validate input integrity before processing. An attacker does not need authentication or prior access; simply presenting the crafted file can trigger the vulnerability. This makes it a high-risk threat vector against systems that automate data ingestion pipelines without rigorous sanitization of incoming files.
Mitigation strategies primarily involve upgrading to HDF5 version 2.2.0 or later, where this heap overflow has been addressed through improved validation checks and bounds checking within the H5VM_array_fill function. Until an upgrade is feasible, organizations should implement strict input validation mechanisms that verify dataset metadata consistency before initiating fill operations. Additionally, deploying memory protection technologies such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the likelihood of successful code execution by making it harder for attackers to predict memory layouts or execute injected shellcode. Regular security audits focusing on third-party library usage in data processing applications are also recommended to identify similar parsing vulnerabilities early in the development lifecycle.