HDF5 EUVD-2026-53676

Q: What is the CVSS score of EUVD-2026-53676?

EUVD-2026-53676 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-19028 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-08-05 HDFG

GHSA-2hg9-348w-39gj

Buffer Overflow Denial Of Service Integer Overflow Hdf5 The Hdf Group

6.8

CVSS 4.0 · Vendor: HDFG

Severity by source

Vendor (HDFG) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

AV:L because a crafted file must be placed locally for processing; UI:R since a user or process must open the file; A:H for crash; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 23:51 vuln.today

Analysis Generated

Aug 05, 2026 - 23:51 vuln.today

DescriptionCVE.org

H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

AnalysisAI

Integer underflow in HDF5 through 2.3.0 allows denial of service when processing Fletcher32-filtered datasets with chunk sizes smaller than 4 bytes. The H5Z__filter_fletcher32 function in H5Zfletcher32.c subtracts the 4-byte checksum length from the input buffer size using an unsigned size_t without first verifying the buffer meets the minimum size, causing the result to wrap near SIZE_MAX and triggering a massively out-of-bounds read inside H5_checksum_fletcher32. Any application or pipeline calling H5Dread on a crafted HDF5 file - including the standard h5ls and h5dump utilities - can be crashed; no public exploit code has been identified and this vulnerability is not in CISA KEV.

Technical ContextAI

HDF5 (Hierarchical Data Format 5) is a scientific data format and library maintained by The HDF Group, used extensively in high-performance computing, research, and data science workflows. The Fletcher32 filter is a checksum filter optionally applied to HDF5 dataset chunks; on decode, the filter strips the 4-byte trailing checksum by subtracting FLETCHER_LEN (4) from nbytes before passing the payload length to H5_checksum_fletcher32. Because nbytes is of type size_t (unsigned), performing this subtraction when nbytes < 4 does not produce a negative number but instead wraps to a value near SIZE_MAX, which is then used as the byte count for a memory read far beyond the actual buffer boundary. CWE-190 (Integer Overflow or Wraparound) is the precise root cause: the assumption that nbytes >= FLETCHER_LEN is never validated. Affected product is identified by CPE cpe:2.3:a:the_hdf_group:hdf5:*:*:*:*:*:*:*:*. The source diff in PR #6497 confirms the fix is a single guard: if (nbytes < FLETCHER_LEN) HGOTO_ERROR(...) inserted before the subtraction.

RemediationAI

Monitor The HDF Group's releases for a tagged version incorporating the fix from PR #6497 (https://github.com/HDFGroup/hdf5/pull/6497) and upgrade HDF5 as soon as that version is published; the exact fix version is not yet confirmed from available data. Until a patched release is available, compensating controls include: (1) rejecting HDF5 files that declare the Fletcher32 filter in dataset creation properties before passing them to H5Dread, which eliminates the vulnerable code path but requires upstream filter inspection logic; (2) sandboxing processes that read untrusted HDF5 files using OS-level isolation (e.g., seccomp, containers, or unprivileged namespaces) to contain crash impact and prevent escalation, noting that this prevents lateral damage but does not prevent the crash itself; (3) restricting ingestion pipelines to HDF5 files from trusted, integrity-verified sources only. No official vendor security advisory URL beyond the GitHub PR and issues is available in the provided data.