TI-2026-21190 Aliases CVE-2026-26199

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

MEDIUM 60CWE-124Published 2026-07-20 · Updated 2026-07-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00351 28th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The HDF Group	hdf5	up to 1.14.6	—	No fix listed	CNA

hdf5 VendorThe HDF Group Affected up to 1.14.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hdfgroup:hdf5::::::::	before 2.1.0	Vulnerable	The HDF Group

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·The HDF Group

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AI Inference Server	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-26199

References

Exploit 1

https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474

Advisory 1

https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc

TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8

See all 140 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences