Read the docs
TI-2026-21188 Aliases CVE-2026-26197

Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c

Priority MEDIUM 60CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupted, it can alter the type of out of bounds read triggered. The vulnerability is present only in files that have been maliciously altered, as its generally not possible to independently alter the full size of the datatype, the element count and the element size. As such, this is only present if a malicious actor is altering files, and won't appear in regular usage.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial hdf5 (HDFGroup): 2.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The HDF Grouphdf5before 2.0.02.0.0Patch availableCNA
  • hdf5 VendorThe HDF Group Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*before 2.1.0VulnerableThe HDF Group
  • cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·The HDF Group

Remediation

  • Fix · CNA hdf5 (HDFGroup) Fixed in 2.0.0

Red Hat 1 advisory

  • RHSA-2026:61630 Released 2026-08-31 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images hdf5-2.2.0-0.1.1.hum1@aarch64, hdf5-2.2.0-0.1.1.hum1@src, hdf5-2.2.0-0.1.1.hum1@x86_64 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:61630

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26197

References

  • TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
  • TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
  • TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
  • TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
  • TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
  • TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
See all 140 →

Sources