CVE-2026-26199

In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.

The HDF5 1.8.16 library has a vulnerability that allows modification of the loop's index when initializing an array, potentially leading to out-of-bounds access. The value used for space allocation comes from the file, creating a risk of manipulation by an attacker.

The HDF5 library version 1.8.16 fails to check if certain message types support a particular flag, leading to casting the structure to an alternative structure and assigning values to fields not supported by the message type. This can result in code execution under the context of the library.

When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library fails to ensure that the precision is within the bounds of the size, leading to arbitrary code execution.

The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.

A vulnerability in HDF5 through 2.3.0 in the H5Z__filter_fletcher32 function in H5Zfletcher32.c. The function computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g., by the h5ls or h5dump tools.

A vulnerability in HDF5 through 2.3.0 in the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c. These functions advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g., by the h5ls or h5repack tools.

H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0. Attackers can cause denial of service via a dataset with 'defined' flag and negative size field.