Quick answers
- Is CVE-2026-29043 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-29043 being exploited in the wild.
- How severe is CVE-2026-29043?
- Medium severity, with a CVSS score of 5.5, published 10 April 2026.
- Which products and versions are affected?
- HDFGroup HDF5 <= 1.14.1-2.
- Is there a fix for CVE-2026-29043?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-29043 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-29043?
- Check whether you run Hdfgroup Hdf5. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow (CWE-122) exists in HDF5 versions 1.14.1-2 and earlier within the H5T__ref_mem_setnull method. The vulnerability is triggered when the library parses a maliciously crafted .h5 file, specifically during memory initialization where the method attempts to overwrite target buffers with null bytes. While the attack typically requires a user to open a malicious file using utilities like h5dump or h5stat (requiring User Interaction), it could also impact server-side processes that automatically parse user-supplied HDF5 files. Successful exploitation can lead to a denial-of-service (DoS) via application crash or potentially remote code execution (RCE), though the nature of the null-byte write may complicate RCE exploitation on modern systems. As of the advisory date, no patched version has been specified.
Affected products
- HDFGroup HDF5 <= 1.14.1-2
Timeline
- 2026-04-10: advisory: Initial advisory published by GitHub and HDFGroup
- 2026-04-10: disclosed: CVE-2026-29043 assigned