CVE-2026-26199
Received Received - Intake

Heap Buffer Overflow in HDF5 Library via H5Iget_name

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-26199
EUVD
EUVD-2026-45970

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hdf_group hdf5 to 1.14.6 (inc)
hdf_group hdf5 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-26199 is a buffer underflow vulnerability in the HDF5 library's H5Iget_name function. When the size parameter is set to zero, the function attempts to write a null terminator to a zero-sized buffer, causing an underflow. This requires the size parameter to be forced to zero and assumes important data exists before the name buffer.

Detection Guidance

To detect this vulnerability, check the version of HDF5 installed on your system using commands like 'h5cc -showconfig' or 'dpkg -l | grep hdf5' on Linux. Compare the version against the affected range (up to 1.14.6).

Review applications using HDF5 functions like H5Iget_name or H5G_get_name for improper size parameter handling. Look for crashes or memory corruption when processing group names.

Impact Analysis

The impact is limited as it requires specific conditions: the size parameter must be forced to zero and there must be important data before the name buffer. This makes exploitation difficult. The vulnerability could potentially lead to memory corruption or crashes in affected HDF5 versions up to 1.14.6.

Compliance Impact

The vulnerability involves a buffer underflow in HDF5 library functions when the size parameter is zero, potentially leading to memory corruption. While not directly tied to compliance standards like GDPR or HIPAA, such memory corruption could compromise data integrity or confidentiality if exploited, indirectly affecting compliance by risking unauthorized data access or modification.

Mitigation Strategies

Upgrade HDF5 to version 2.1.0 or later immediately. This patched version addresses the buffer underflow issue in H5Iget_name and related functions.

Audit applications using HDF5 libraries to ensure size parameters are validated before calling functions like H5Iget_name. Avoid passing zero as the size parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart