HDF5 CVE-2026-26199

Q: What is the CVSS score of CVE-2026-26199?

CVE-2026-26199 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45970 MEDIUM

Buffer Underwrite ('Buffer Underflow') (CWE-124)

2026-07-20 GitHub_M

Information Disclosure Hdf5

5.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

File delivered over network (AV:N), specific size=0 trigger condition required (AC:H), no privileges needed (PR:N), victim must open crafted file (UI:R), confirmed impact is crash only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:12 vuln.today

DescriptionCVE.org

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Iget_name is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Iget_name is invoked in a way where size can be forced to zero, and there is important data before the name buffer.

AnalysisAI

Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation.

Technical ContextAI

HDF5 (Hierarchical Data Format version 5) is a high-performance scientific data library and file format maintained by The HDF Group (CPE: cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*). The affected function H5Iget_name retrieves the string name of an HDF5 object given its identifier; the size parameter is intended to bound the destination buffer. The defect manifests in H5Gname.c at line 474: when size equals zero, the arithmetic computing the null terminator's write offset underflows, producing a write position before the start of the name buffer. CWE-124 (Buffer Underwrite / 'Buffer Underflow') precisely classifies this root cause - a computed write index falls below the buffer's base address, corrupting adjacent heap metadata or live application data. The vendor-supplied 'Information Disclosure' tag suggests that under specific heap layouts the underflowing write or subsequent misread could expose memory contents preceding the name buffer, though the CVSS 4.0 vector records VC:N indicating no confirmed confidentiality impact in the primary exploit scenario - this is a minor conflicting signal that warrants verification against the full advisory.

RemediationAI

The primary fix is to upgrade HDF5 beyond version 1.14.6 once a patched release is published by The HDF Group. At time of analysis, a specific patched release version is not independently confirmed from the supplied data - the upstream fix is visible in the develop branch at https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474, but a formally tagged release has not been confirmed in the available intelligence; the vendor advisory at https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc should be consulted directly to obtain the confirmed fix version before upgrading. As a compensating control prior to patching, any application calling H5Iget_name should guard that the size argument is never zero before the function is invoked - a single conditional check prevents the underflow entirely with no functional side effects. Additionally, restrict HDF5 file ingestion strictly to verified, trusted sources and reject or sandbox externally supplied files; this eliminates the delivery vector without requiring a library change.