HDF5 Library: Three DoS Vulnerabilities Disclosed Together on July 28, 2026
Three vulnerabilities in the HDF5 library, disclosed on July 28, 2026, allow for denial-of-service attacks through specially crafted HDF5 files.
Key findings
- Three HDF5 vulnerabilities disclosed together on July 28, 2026, pose DoS risks.
- CVE-2026-17574: NULL pointer dereference via crafted attribute.
- CVE-2026-17573: Double free in h5repack via oversized chunk size.
- CVE-2026-17572: Heap overflow in SOHM deserialization (HDF5 through 2.1.1).
- All vulnerabilities are triggered by processing malformed HDF5 files.
On July 28, 2026, a batch of three vulnerabilities affecting the HDF5 data format library was disclosed. These vulnerabilities, all stemming from the processing of specially crafted HDF5 files, pose a risk of denial-of-service (DoS) through application crashes or aborts. The disclosures highlight potential weaknesses in how HDF5 handles malformed data, which could be exploited by attackers to disrupt services relying on the library.
The vulnerabilities fall into distinct categories based on their impact:
- NULL Pointer Dereference: CVE-2026-17574 describes a NULL pointer dereference vulnerability. This occurs when an HDF5 file contains an attribute with an invalid variable-length datatype type field. When this attribute is read, it can lead to a crash in the application using the HDF5 library.
- Double Free: CVE-2026-17573 addresses a double free vulnerability. This flaw is triggered by processing an HDF5 file with an oversized chunk size field, particularly when using the
h5repackutility. A double free condition can lead to memory corruption and application instability, often resulting in an abort.
- Heap-Based Buffer Overflow: CVE-2026-17572 details a heap-based buffer overflow within the SOHM list-index deserialization code. If a crafted HDF5 file declares a
num_messagescount that exceeds thelist_maxin its shared-message list index, it can trigger out-of-bounds heap reads and writes, ultimately causing a denial-of-service. The affected versions are noted as HDF5 through 2.1.1.
These vulnerabilities collectively present a DoS risk to any application or system that processes HDF5 files. The common thread is the library's susceptibility to malformed input, underscoring the importance of input validation and robust error handling when dealing with complex file formats. Users of the HDF5 library should be aware of these potential crash vectors and ensure they are applying necessary updates or implementing mitigations where possible.
As of the disclosure date, there is no information indicating these vulnerabilities are being actively exploited in the wild. However, the nature of these flaws means that any system processing untrusted HDF5 files could be at risk. The HDF Group and Debian are expected to provide further guidance and patches for affected versions. Users are advised to consult official advisories for the most up-to-date information on mitigation and remediation strategies.
The disclosure of these three distinct vulnerabilities in a single batch emphasizes the need for continuous security vigilance within the HDF5 ecosystem. While these specific flaws primarily lead to denial-of-service conditions, they serve as a reminder that complex data-handling libraries can harbor subtle bugs that attackers may seek to exploit. Staying informed about security advisories and promptly applying updates remains crucial for maintaining the integrity and availability of systems relying on HDF5.