Executive brief
HDF5 is a widely used data management library for storing and managing large amounts of complex data. A vulnerability in how the library processes certain file structures allows an attacker to crash applications that open a specially crafted, malicious HDF5 file. This could lead to a denial of service, impacting operations that rely on processing external data files.
Technical details
A heap-based buffer overflow exists in the Shared Object Header Message (SOHM) list-index deserialization component of HDF5. The vulnerability is located in the H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum functions, which fail to validate that the 'num_messages' count from the on-disk index header does not exceed 'list_max'. An attacker can provide a malformed HDF5 file that triggers out-of-bounds heap reads and writes. This requires a user to open the malicious file (User Interaction). The issue affects HDF5 through version 2.1.1 across all platforms.
Affected products
- The HDF Group HDF5 <= 2.1.1
Timeline
- 2026-07-02: disclosed: Issue reported on GitHub
- 2026-07-27: advisory: NVD publication date