Skip to main content

HDF5 EUVDEUVD-2026-53678

| CVE-2026-19027 MEDIUM
Out-of-bounds Read (CWE-125)
2026-08-05 HDFG GHSA-2pvh-qgr3-wp2r
Buffer Overflow Information Disclosure Hdf5 Suse Red Hat
6.9
CVSS 4.0 · Vendor: HDFG
Share

Severity by source

Vendor (HDFG) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

File must be locally opened by a user or tool (AV:L, UI:R); no privileges needed to deliver a file (PR:N); heap disclosure is limited (C:L) and crashes are reliable (A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.6 MEDIUM
qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 05, 2026 - 23:52 vuln.today
Analysis Generated
Aug 05, 2026 - 23:52 vuln.today

DescriptionCVE.org

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.

AnalysisAI

Out-of-bounds heap read in HDF5's N-Bit filter decompression affects all versions through 2.3.0, allowing an attacker who can deliver a crafted HDF5 file to a user or automated pipeline to trigger application crashes and, in constrained cases, leak adjacent heap memory contents into decompressed dataset values. The three affected functions - H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic - advance a buffer read index without bounding it against the actual compressed chunk size, exploitable whenever H5Dread is invoked, including via common tools like h5ls and h5repack. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious HDF5 file with N-Bit filter params
Delivery
Deliver file to target pipeline or user
Exploit
User/tool invokes H5Dread on dataset
Execution
Unbounded index walks past heap chunk boundary
Impact
Crash (DoS) or heap memory leaks into dataset output
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that (1) the target application or tool opens a crafted HDF5 file containing a dataset with the N-Bit compression filter applied, (2) H5Dread is called on that dataset - which occurs automatically when using h5ls or h5repack - and (3) the N-Bit filter parameters in the file describe more decompressed data than the compressed chunk actually stores. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) indicates local file-delivery attack surface with passive user interaction and high availability impact alongside low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious HDF5 file whose N-Bit filter metadata claims a larger decompressed element count than the compressed chunk actually contains, then delivers it to a victim organization's data-ingestion pipeline or scientific data portal. When a researcher or automated job runs h5ls or h5repack on the file, H5Dread invokes the vulnerable N-Bit decompression path, the unbounded index walks off the end of the heap-allocated chunk buffer, causing the process to crash (denial of service) or to return heap memory adjacent to the chunk into the decompressed dataset - which an attacker with read-back access to the output could inspect for sensitive in-process data. …
Remediation Apply the upstream fix from GitHub PR #6497 (https://github.com/HDFGroup/hdf5/pull/6497), which adds buffer bounds validation throughout the N-Bit decompression path and hardens the cd_values parameter check. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hdf5

View all
CVE-2018-13876 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13874 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13873 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13872 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13871 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13870 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13869 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13868 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13867 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13866 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2017-17509 HIGH POC
8.8 Dec 11

In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhd
CVE-2025-44904 HIGH POC
8.8 May 30

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Rated high severity (CVSS

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for HPC 12 Affected

Share

EUVD-2026-53678 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy