Executive brief
A security flaw has been identified in the HDF5 library, a widely used tool for managing large and complex data collections. By tricking a user into processing a specially crafted data file using the h5repack utility, an attacker can cause the application to crash. This could lead to a denial-of-service, disrupting data processing workflows and research operations.
Technical details
A double free vulnerability (CWE-415) exists in the HDF5 library, specifically within the h5repack utility. The issue is triggered when the utility processes a crafted HDF5 file that contains an oversized chunk size field. This improper memory management occurs during file processing, leading to an application crash (denial of service). Exploitation requires a local attacker to provide a malicious file that is then processed by a user or automated system using h5repack. The vulnerability is reported to affect versions up to and including 2.1.1 on Linux platforms.
Affected products
- The HDF Group HDF5 <= 2.1.1
Timeline
- 2026-07-27: disclosed: CVE published to NVD dataset