Executive brief
HDF5 is a high-performance data management library used to store and organize large amounts of data. A vulnerability exists where processing a specially crafted HDF5 file can cause applications using the library to crash. This could lead to a denial-of-service, interrupting research or business operations that rely on processing these data files.
Technical details
A NULL pointer dereference and reachable assertion vulnerability exists in HDF5's H5O__dtype_decode_helper() and H5T_set_loc() functions. The root cause is a failure to validate the 'vlen.type' field during the decoding of variable-length datatypes; if the field contains a value other than H5T_VLEN_SEQUENCE or H5T_VLEN_STRING, it triggers an assertion failure in debug builds or a segmentation fault in release builds. An attacker can exploit this by providing a malformed HDF5 file to an application that reads its attributes. A fix has been developed that adds validation checks during decoding and ensures file pointers are not NULL before processing.
Affected products
- The HDF Group HDF5 <= 2.1.1
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory