Hdfgroup Hdf5 vulnerabilities

CVE-2024-32606 [MEDIUM] CWE-908 CVE-2024-32606: HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).

CVE-2025-7068 [MEDIUM] CWE-401 CVE-2025-7068: A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affe A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

CVE-2026-17572 [MEDIUM] CWE-125 CVE-2026-17572: Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and

CVE-2021-45830 [MEDIUM] CWE-787 CVE-2021-45830: A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/ A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which could cause a Denial of Service.

CVE-2021-45833 [MEDIUM] CWE-787 CVE-2021-45833: A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_m A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function in /hdf5/src/H5Dchunk.c, which causes a Denial of Service (context-dependent).

CVE-2020-10811 [MEDIUM] CWE-125 CVE-2020-10811: An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an attacker to cause Denial of Service.

CVE-2026-17573 [MEDIUM] CWE-415 CVE-2026-17573: A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file conta A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

CVE-2021-45829 [MEDIUM] CWE-404 CVE-2021-45829: HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service. HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service.

CVE-2020-10812 [MEDIUM] CWE-476 CVE-2020-10812: An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5 An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service.

CVE-2026-17574 [MEDIUM] CWE-476 CVE-2026-17574: HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

CVE-2020-10810 [MEDIUM] CWE-476 CVE-2020-10810: An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5 An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service.

CVE-2025-2923 [LOW] CWE-119 CVE-2025-2923: A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected A vulnerability, which was classified as problematic, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5F_addr_encode_len of the file src/H5Fint.c. The manipulation of the argument pp leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

CVE-2025-2914 [LOW] CWE-119 CVE-2025-2914: A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the func A vulnerability classified as problematic has been found in HDF5 up to 1.14.6. This affects the function H5FS__sinfo_Srialize_Sct_cb of the file src/H5FScache.c. The manipulation of the argument sect leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

CVE-2025-6816 [LOW] CWE-119 CVE-2025-6816: A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the f A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

CVE-2025-6750 [LOW] CWE-119 CVE-2025-6750: A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. Affected by thi A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. Affected by this issue is the function H5O__mtime_new_encode of the file src/H5Omtime.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

CVE-2025-6817 [LOW] CWE-400 CVE-2025-6817: A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affe A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry.c. The manipulation leads to resource consumption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.