HDFGroup HDF5 up to 1.x Array datatype size/nelem/element size out-of-bounds

Summaryinfo

A vulnerability labeled as critical has been found in HDFGroup HDF5 up to 1.x. The affected element is an unknown function of the component Array datatype. The manipulation of the argument size/nelem/element size results in out-of-bounds. This vulnerability was named CVE-2026-26197. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in HDFGroup HDF5 up to 1.x. Affected is an unknown part of the component Array datatype. The manipulation of the argument size/nelem/element size with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-26197 since 02/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 2.0.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• HDFGroup

Name

• HDF5

Version

• 1.x

License

• free

Website

• Product: https://github.com/HDFGroup/hdf5/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion