TI-2026-69084 Aliases CVE-2026-106547 GHSA-p24g-8x6r-2v93

Heap buffer overflow in HDF5 H5VM_array_fill via crafted file

LOW 38CWE-122Published 2026-10-06 · Updated 2026-10-07

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

HDF5 from 1.10.0 before 2.2.0 contains a heap-based buffer overflow (CWE-122) in H5VM_array_fill. When an application reads unallocated chunks, inconsistent datatype or dataspace metadata in the file makes the fill-value write exceed the buffer. A remote attacker can crash an application and possibly execute arbitrary code with a crafted HDF5 file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00163 5th percentileScored 2026-11-07

Fix Fixed HDF5 (The HDF Group): 2.2.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The HDF Group	HDF5	1.10.0 to before 2.2.0	2.2.0	Patch available	CNA

HDF5 VendorThe HDF Group Affected 1.10.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hdfgroup:hdf5::::::::	—	—	The HDF Group

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions — — ·The HDF Group

Remediation

Upgrade HDF5 to version 2.2.0 or later. Red Hat fixed Hardened Images in RHSA-2026:73539, released 2026-09-29.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA HDF5 (The HDF Group) Fixed in 2.2.0

Red Hat 1 advisory

RHSA-2026:73539 Released 2026-09-29 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images hdf5-2.2.0-0.1.2.hum1@aarch64, hdf5-2.2.0-0.1.2.hum1@src, hdf5-2.2.0-0.1.2.hum1@x86_64 +18

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Fixed	RHSA-2026:73539

Timeline

2026-10-07 Threatist record created from CVE-2026-106547
2026-10-07 Alias added: GHSA-p24g-8x6r-2v93
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: MEDIUM → LOW
2026-10-20 Fix available: RHSA-2026:73539 · Red Hat
2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
2026-10-20 CVSS score added · Red Hat

References

Other 1

https://github.com/HDFGroup/hdf5/pull/6529

TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
TI-2026-15548 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message CVSS 4.0HIGH 8.2

See all 150 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences