Description
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.
Published: 2026-07-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A corrupted HDF5 file can present an array datatype in which the declared full size, the element count, and the element size are not internally consistent. When the HDF5 library parses such a datatype it may read beyond the bounds of the allocated buffer, which can leak memory contents or crash the process. The flaw is only triggered by maliciously altered files and does not occur under normal operation.

Affected Systems

The defect resides in the HDF5 library from HDFGroup. It is triggered only when an HDF5 file with corrupted array datatype metadata—improperly matching full size, element count, and element size—explores such a file. Any application that loads untrusted HDF5 files could be impacted. Regular use with genuine files is unaffected, as the corruption would need to be introduced maliciously.

Risk and Exploitability

The CVSS score of 5.9 indicates a medium‑severity vulnerability. The EPSS score is below 1% and the issue is not listed in CISA KEV, suggesting limited exploitation in the wild. The likely attack vector involves delivering a specially crafted HDF5 file to a process that opens or parses it; the corrupt array metadata causes the library to perform an out‑of‑bounds read, potentially exposing private data or causing a denial of service.

Generated by OpenCVE AI on July 30, 2026 at 19:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update HDF5 to the latest release that addresses this vulnerability
  • If a patch is not immediately available, validate that the product of element size and element count equals the declared full size before passing a file to the library, rejecting any mismatch
  • Run any HDF5‑consuming application in a sandboxed or separate process to isolate a potential crash
  • Prefer to acquire HDF5 files that are signed or include checksum verification, rejecting those that fail integrity checks

Generated by OpenCVE AI on July 30, 2026 at 19:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 21 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Hdfgroup
Hdfgroup hdf5
Vendors & Products Hdfgroup
Hdfgroup hdf5

Mon, 20 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.
Title Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Hdfgroup Hdf5
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T15:34:11.301Z

Reserved: 2026-02-11T19:56:24.813Z

Link: CVE-2026-26197

cve-icon Vulnrichment

Updated: 2026-07-20T15:34:04.810Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-20T14:55:50Z

Links: CVE-2026-26197 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:30:09Z

Weaknesses