2
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
50.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-26199 | Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation. | MEDIUM | 5.9 | 0.3% | 30 |
No patch
|
| CVE-2026-26197 | Out-of-bounds read in HDF5 (all versions prior to 2.0.0) is triggered when parsing a maliciously crafted file whose array datatype metadata violates the internal invariant that element_size × nelem must equal the stored full datatype size. When a victim opens such a file, the HDF5 parser reads beyond its intended buffer boundary, causing application crash or potential memory disclosure. No active exploitation is confirmed in CISA KEV, but SSVC intelligence confirms a POC exists, and the vendor has released a patch in version 2.0.0. | MEDIUM | 5.9 | 0.3% | 30 |
|