HDF5 EUVD-2026-53686

Q: What is the CVSS score of EUVD-2026-53686?

EUVD-2026-53686 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-19025 MEDIUM

Divide By Zero (CWE-369)

2026-08-05 HDFG

GHSA-546v-jw2p-gc8p

Denial Of Service Hdf5 The Hdf Group

6.8

CVSS 4.0 · Vendor: HDFG

Severity by source

Vendor (HDFG) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

File must be locally opened by user or process (AV:L/UI:R); no privileges required to open a file; impact is crash-only with no scope change (A:H, C:N/I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 23:31 vuln.today

DescriptionCVE.org

H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.

AnalysisAI

HDF5 library through version 2.3.0 crashes with a divide-by-zero when a process opens a crafted file containing mismatched chunk-layout and dataspace dimensionality. The missing rank validation in H5O__layout_decode allows the corrupt metadata to propagate unchecked to H5S__hyper_iter_get_seq_list, where the invalid value causes integer division by zero and application termination. Tools that automatically consume externally-supplied HDF5 files - such as the bundled h5repack utility - are the primary exposure surface; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

HDF5 (Hierarchical Data Format version 5) is a binary scientific data format and supporting C library developed by The HDF Group, widely used in research computing for storing large multidimensional arrays. The library stores dataset layout metadata - including chunked storage geometry - in the file's object header. The function H5O__layout_decode in H5Olayout.c deserializes this layout metadata when an existing dataset is opened. At dataset-creation time, the library validates that the chunk-layout dimensionality matches the dataspace rank, but this check is not repeated when reopening an existing dataset via H5Dopen2. CWE-369 (Divide By Zero) is the root cause class: when H5Dread is subsequently called, the corrupted rank value propagates to the hyperslab iterator H5S__hyper_iter_get_seq_list in src/H5Shyper.c, where a rank-dependent divisor is zero, causing an arithmetic fault and process crash. The affected CPE is cpe:2.3:a:the_hdf_group:hdf5:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version has been confirmed from the available data - the sole reference is a GitHub issue report rather than a tagged release or formal security advisory. Monitor https://github.com/HDFGroup/hdf5/issues/6491 and the HDF Group release page for a patched version and upgrade as soon as one is available. As a compensating control in the interim, restrict h5repack and other HDF5-consuming tools from processing untrusted or externally-sourced HDF5 files; implement allow-listing of trusted data sources in automated pipelines. Where file-processing cannot be restricted, sandbox the consuming process (e.g., via seccomp, containers, or a dedicated low-privilege user) so that a crash terminates only the sandboxed worker rather than a broader service. Note that sandboxing does not prevent the crash - it limits its downstream impact. Validating HDF5 file provenance via checksums or signatures before processing is the most effective compensating control prior to patch availability.