Szip Filter
Monthly
HDF5 through 2.2.0, when compiled with szip support, reads past the end of a chunk buffer while decoding a szip-compressed chunk in H5Z__filter_szip(): the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying the chunk is longer than that header, so a truncated or corrupted chunk record makes the size_t subtraction wrap to a very large value and the decompressor reads far beyond the stored data, crashing the process. An attacker triggers it by getting a user or application to read a dataset from a crafted HDF5 file, so the attack is local (AV:L) and requires the victim to open the file (UI:R / UI:P), with impact confined to denial of service (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CVSS 4.0 4.7). Only szip-enabled builds (libaec or the szip library) are affected, the CVE is not in CISA KEV, and the CVSS 4.0 vector records Proof-of-Concept-level exploit maturity (E:P) while no verified working exploit code is identified in the available sources; the issue is rated medium severity and prioritized 'this_month' rather than as an emergency.
HDF5 through 2.2.0, when compiled with szip support, reads past the end of a chunk buffer while decoding a szip-compressed chunk in H5Z__filter_szip(): the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying the chunk is longer than that header, so a truncated or corrupted chunk record makes the size_t subtraction wrap to a very large value and the decompressor reads far beyond the stored data, crashing the process. An attacker triggers it by getting a user or application to read a dataset from a crafted HDF5 file, so the attack is local (AV:L) and requires the victim to open the file (UI:R / UI:P), with impact confined to denial of service (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CVSS 4.0 4.7). Only szip-enabled builds (libaec or the szip library) are affected, the CVE is not in CISA KEV, and the CVSS 4.0 vector records Proof-of-Concept-level exploit maturity (E:P) while no verified working exploit code is identified in the available sources; the issue is rated medium severity and prioritized 'this_month' rather than as an emergency.