CVE-2026-26197
Received Received - Intake

Out-of-Bounds Read in HDF5 Library

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-26197
EUVD
EUVD-2026-45969

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hdf_group hdf5 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-26197 is an out-of-bounds read vulnerability in the HDF5 library. It occurs when a file is corrupted so that an array datatype's full size, element count, and element size are inconsistent. Normally, element size multiplied by element count should equal the full size. If corrupted, this misalignment can trigger an out-of-bounds read, potentially causing crashes or other unexpected behavior.

Detection Guidance

Detecting this vulnerability requires checking HDF5 files for corrupted datatype metadata. Use the HDF5 library's built-in tools like h5ls or h5dump to inspect files for inconsistencies in array datatype sizes. Compare the full datatype size against the product of element count and element size. Malicious files may trigger crashes when processed by HDF5 utilities.

Impact Analysis

This vulnerability can impact you if you process maliciously altered HDF5 files. It may cause crashes in applications using the HDF5 library, such as those handling H5Aint.c, H5Tconv_compound.c, H5Dselect.c, or H5Tconv_integer.c. Regular usage of uncorrupted files is not affected.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it requires malicious file alteration to trigger. It primarily affects data integrity and availability in HDF5 files rather than privacy or security controls.

Mitigation Strategies

Upgrade to HDF5 version 2.1.0 or later, which includes the patch for this issue. Avoid processing untrusted HDF5 files until the upgrade is complete. Monitor systems for crashes when handling HDF5 files, as these may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart