hdf5: HDF5 library: Denial of Service via crafted HDF5 file processing

A flaw was found in the HDF5 library. A local user could exploit a double free vulnerability by processing a specially crafted HDF5 file with an oversized chunk size field using the h5repack tool. This could cause the application to unexpectedly terminate, leading to a denial of service...

JLSEC-2026-1385

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

PT-2026-85163

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-19027: Out-of-bounds Read

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

PT-2026-68348

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description The H5Z filter nbit function in H5Znbit.c dereferences cd values0 through cd values4 without verifying that cd values is non-NULL or that cd nelmts is at least 5, which is the required size for the filt...

PT-2026-68353

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description The functions H5Z nbit decompress one byte, H5Z nbit decompress one nooptype, and H5Z nbit decompress one atomic in H5Znbit.c advance a read index into the compressed chunk buffer without bounding it...

CVE-2026-19026: NULL Pointer Dereference

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-17573

A flaw was found in the HDF5 library. A local user could exploit a double free vulnerability by processing a specially crafted HDF5 file with an oversized chunk size field using the h5repack tool. This could cause the application to unexpectedly terminate, leading to a denial of service...

AZL-94013 CVE-2026-17573 affecting package hdf5 for versions less than 1.14.6-4

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

DEBIAN-CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-17573

The CVE-2026-17573 entry concerns the HDF5 library, specifically a vulnerability in H5D__chunk_copy() triggered by processing a crafted HDF5 file with an oversized chunk-size field. The issue can cause an application abort due to a double-free condition when using h5repack. Affected component: HD...

CVE-2026-17573 Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

EUVD-2026-49319

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...

CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free...