HDF5 EUVD-2026-115545

Exploitation requires the victim to open an attacker-crafted HDF5 file (AV:L, UI:P) and for the application to perform a group-iteration operation that reaches the vulnerable code path - specifically H5Gget_info() or H5Gget_num_objs() on a group, which calls into H5B_iterate() via H5G__obj_info() and H5G__stab_count(). The malicious file must contain a version 1 B-tree with a child pointer that refers back to a node already loaded in the metadata cache (e.g. a node pointing to itself), bypassing the level check that only runs in H5B__cache_deserialize(). Limiting factors: no network vector (local file handling required), required user interaction to open the file, and availability-only impact (process crash); there is no code execution or data disclosure. Affects HDF5 through 2.2.0.

This is a genuine but low-urgency vulnerability. The CVSS 4.0 base score is 4.3 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, meaning the only impact is availability (a crash) with no confidentiality or integrity effect. The exploitation-maturity metric is E:U (exploit not reported/unproven), there is no CISA KEV listing, and no EPSS score was supplied in the input. The vuln.today priority decision label is 'this_month', which is consistent with a real-but-not-emergency issue: a denial-of-service that requires AV:L (the attacker cannot reach it over the network - a malicious file must be opened on the host) and UI:P (the victim must take an action, i.e. open the crafted file). The signals are mutually consistent rather than conflicting: medium CVSS, no active exploitation, user-interaction and local-file prerequisites, and availability-only impact all point to a low-to-moderate real-world priority. No EPSS value was provided, so widespread-exploitation probability cannot be quantified from the input. This is best treated as a stability/robustness bug to patch on a normal cycle rather than a high-priority incident, because the worst outcome is a crash of the process parsing the file.

An attacker crafts a malicious HDF5 file containing a version 1 B-tree whose child pointer refers back to a node already in the metadata cache (for example, a node that points to itself). They send or host the file and get a user or an automated pipeline to open it; when the application calls H5Gget_info() or H5Gget_num_objs() on a group, the library enters unbounded recursion and exhausts the stack, crashing the process. No public exploit was identified at time of analysis, and the attack requires local file handling plus user interaction, so it is limited to denial of service.