Executive brief
HDF5 is a widely used library and file format for managing and storing large amounts of complex data. A vulnerability exists where a specially crafted data file can cause the software to crash or behave unexpectedly when opened. This could lead to a service outage or, in some cases, allow an attacker to gain unauthorized control over the system processing the file.
Technical details
A heap-based buffer overflow (CWE-122) exists in HDF5 versions 1.14.1-2 and earlier within the H5T__ref_mem_setnull method. The vulnerability is triggered when the library parses a maliciously crafted .h5 file, specifically during memory initialization where the method attempts to overwrite target buffers with null bytes. While the attack typically requires a user to open a malicious file using utilities like h5dump or h5stat (requiring User Interaction), it could also impact server-side processes that automatically parse user-supplied HDF5 files. Successful exploitation can lead to a denial-of-service (DoS) via application crash or potentially remote code execution (RCE), though the nature of the null-byte write may complicate RCE exploitation on modern systems. As of the advisory date, no patched version has been specified.
Affected products
- HDFGroup HDF5 <= 1.14.1-2
Timeline
- 2026-04-10: advisory: Initial advisory published by GitHub and HDFGroup
- 2026-04-10: disclosed: CVE-2026-29043 assigned