Executive brief
HDF5 is a data management library used to store and organize large amounts of data. A security flaw in its 'h5dump' utility could allow an attacker to execute malicious code or crash the application if a user is tricked into opening a specially crafted data file. This could lead to a full system compromise or a disruption of operations depending on how the software is used.
Technical details
A heap use-after-free vulnerability exists in the h5dump helper utility of HDF5 versions 1.14.1-2 and earlier. The flaw occurs when a freed object, originally allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term, is subsequently referenced in a memmove call within H5T__conv_struct. An attacker can exploit this by providing a malicious HDF5 (.h5) file. While the primary attack vector requires a user to parse the file with h5dump (UI:R), server-side processes automatically parsing attacker-controlled files may also be at risk. Successful exploitation can lead to arbitrary code execution or a denial-of-service (DoS) condition.
Affected products
- HDFGroup hdf5 <= 1.14.1-2
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 affected
Timeline
- 2026-04-09: disclosed: Initial disclosure by HDFGroup and Red Hat
- 2026-04-09: advisory: GitHub Advisory GHSA-w7v2-9cmr-pwwj published