Description
HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.
Published: 2026-04-09
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a heap use‑after‑free in the h5dump helper utility of HDF5. A malicious .h5 file can trigger a call to memmove that accesses memory that has already been freed, producing memory corruption that can corrupt data structures or crash the process.

Affected Systems

HDFGroup’s HDF5 library, versions 1.14.1, 1.14.2, and earlier, is affected when the h5dump utility is used. Any installation that processes external HDF5 files with these releases is vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % shows a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted .h5 file to the target system’s h5dump utility or application that uses it; processing the file can lead to instability or data corruption.

Generated by OpenCVE AI on April 14, 2026 at 23:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade HDF5 to a version that includes the fix, such as 1.14.3 or later.
  • Run the h5dump utility only with trusted input files and limit its execution to authorized users or environments.
  • If h5dump is not required, disable or remove the utility from the system to eliminate the attack surface.

Generated by OpenCVE AI on April 14, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

Mon, 13 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Hdfgroup
Hdfgroup hdf5
Vendors & Products Hdfgroup
Hdfgroup hdf5

Thu, 09 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Description HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.
Title HDF5: H5T__conv_struct Use After Free
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Hdfgroup Hdf5
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-13T20:47:37.724Z

Reserved: 2026-03-30T18:41:20.754Z

Link: CVE-2026-34734

cve-icon Vulnrichment

Updated: 2026-04-13T20:47:29.888Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T20:16:25.437

Modified: 2026-04-14T20:09:51.313

Link: CVE-2026-34734

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-09T19:01:21Z

Links: CVE-2026-34734 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T16:00:07Z

Weaknesses