What is the CVSS score of CVE-2026-26200?

CVE-2026-26200 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Hdf5 are affected by CVE-2026-26200?

CVE-2026-26200 is a HIGH severity vulnerability affecting HDF5 data management software that allows attackers to execute arbitrary code by uploading malicious data files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26200?

Yes, a public proof-of-concept exploit is available for CVE-2026-26200. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26200?

Within 24 hours: Identify all systems running HDF5 and restrict file upload/import capabilities to trusted sources only; disable HDF5 processing of untrusted files if operationally feasible. Within 7 days: Implement network segmentation to isolate HDF5-dependent systems; deploy monitoring for suspicious file access and process execution on affected systems. Within 30 days: Monitor vendor security advisories for patch availability; evaluate migration to patched version 1.14.4-2 or later once released; conduct risk assessment to determine if systems must remain unpatched.

Hdf5 CVE-2026-26200

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-19 security-advisories@github.com

RCE Buffer Overflow Heap Overflow Hdf5

7.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 08:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 20:14 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 20:25 nvd

HIGH 7.8

DescriptionCVE.org

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.

AnalysisAI

Heap buffer overflow in HDF5 versions prior to 1.14.4-2 allows attackers to trigger denial-of-service or potentially achieve code execution by crafting malicious h5 files. The vulnerability affects any system parsing untrusted HDF5 data files and has public exploit code available. A patch is not yet available, leaving affected deployments at risk.

Technical ContextAI

Classified as CWE-122 (Heap-based Buffer Overflow). Affects Hdf5. HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixe

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible.