What is the CVSS score of CVE-2026-34734?

CVE-2026-34734 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Hdf5 are affected by CVE-2026-34734?

CVE-2026-34734 is a heap use-after-free vulnerability in HDF5's h5dump utility (versions 1.14.1-2 and earlier) that allows local attackers to execute arbitrary code by inducing users to open…. A patch is available.

How to fix or mitigate CVE-2026-34734?

Within 24 hours: identify all systems running HDF5 versions 1.14.1-2 or earlier using software inventory tools; notify data stewards and researchers to suspend opening HDF5 files from untrusted sources. Within 7 days: implement file-source validation policies; restrict h5dump execution to isolated environments or dedicated analysis systems; establish user awareness training on malicious file risks. Within 30 days: monitor HDFGroup for patch release to version 1.14.2 or later; test patch in development environment; deploy to production systems following change management protocols.

Hdf5 CVE-2026-34734

EUVD-2026-21020 HIGH

Use After Free (CWE-416)

2026-04-09 GitHub_M

Memory Corruption Information Disclosure Use After Free Hdf5

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 19:45 euvd

EUVD-2026-21020

Analysis Generated

Apr 09, 2026 - 19:45 vuln.today

CVE Published

Apr 09, 2026 - 19:01 nvd

HIGH 7.8

DescriptionCVE.org

HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.

AnalysisAI

Heap use-after-free in HDF5 h5dump utility allows local attackers to achieve arbitrary code execution when processing malicious HDF5 files. Affects HDF5 versions 1.14.1-2 and earlier from HDFGroup. Attacker must convince user to open crafted file (user interaction required, CVSS UI:R). Unauthenticated attack vector enables high-impact compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis. Vulnerability stems from premature deallocation in H5D__typeinfo_term followed by unsafe reference in H5T__conv_struct memmove operation.

Technical ContextAI

CWE-416 use-after-free occurs when H5D__typeinfo_init_phase3 allocates heap object later freed by H5D__typeinfo_term, then H5T__conv_struct references freed memory via memmove during struct conversion. Temporal gap between deallocation and reference creates exploitable window for memory manipulation through malformed HDF5 file structures processed by h5dump helper utility.

RemediationAI

No vendor-released patch identified at time of analysis. Monitor HDFGroup security advisory at https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj for patch availability and upgrade guidance. Until patched version releases, restrict h5dump usage to trusted HDF5 files only. Implement input validation controls to block untrusted file processing. Deploy h5dump in sandboxed environments with limited privileges to contain potential exploitation. Consider disabling h5dump utility in production environments where file provenance cannot be verified. Organizations should establish file validation procedures and security awareness training regarding risks of opening HDF5 files from untrusted sources.