349 matches found
CVE-2026-9335
CVE-2026-9335 concerns keras-team/keras ≤ 3.14.0, where improper handling of HDF5 ExternalLinks in ExternalLink resolution allows arbitrary local HDF5 file content disclosure. The vulnerability arises because KerasFileEditor and keras.saving.load_weights bypass safe_get_h5_group and safe_get_h5_d...
Linux Distros Unpatched Vulnerability : CVE-2026-9335
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The...
CVE-2026-17572
A flaw was found in HDF5, a data management library. This vulnerability, a heap-based buffer overflow, allows a local attacker to cause a denial of service DoS by persuading a user to open a specially crafted HDF5 file. The malformed file can trigger out-of-bounds memory operations, leading to...
CVE-2026-17574
A flaw was found in HDF5. A local user can exploit this vulnerability by processing a specially crafted HDF5 file. This file, containing an attribute with an invalid variable-length datatype, can cause a NULL pointer dereference, leading to an application crash and resulting in a denial of servic...
DEBIAN-CVE-2026-17572
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...
UBUNTU-CVE-2026-17573
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-17574 NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
CVE-2026-17574
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
CVE-2026-17573 Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-17573
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-17573 Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-17573
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-17572
CVE-2026-17572 : In HDF5 (vulnerable through 2.1.1), the SOHM list-index deserialization code is vulnerable to a heap-based buffer overflow. A crafted HDF5 file whose shared-message list index declares a num_messages greater than list_max can trigger out-of-bounds heap reads/writes in H5SM__cache...
CVE-2026-17572 HDF5 SOHM List Index Heap Buffer Overflow
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...
CVE-2026-17572 HDF5 SOHM List Index Heap Buffer Overflow
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...
PT-2026-64977
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...
PT-2026-64976
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...
CVE-2026-26199 Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...
EUVD-2026-45970
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...
EUVD-2026-45969
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...