Back to overview

CVE-2026-17572

MEDIUM
5.5
CVSS 4.0
Description
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.

Metadata

CVE ID
CVE-2026-17572
State
PUBLISHED
Assigner
HDFG
Reserved
2026-07-27 15:07 UTC
Published
2026-07-27 15:11 UTC
Last updated
2026-07-27 15:11 UTC
Primary CWE
CWE-125
CWE-125 Out-of-bounds read
Vendor / Product
The HDF Group / HDF5
Sources
cve.org  ·  NVD

Severity & Metrics

5.5 MEDIUM CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U
Affected products (1)
VendorProductPlatformVersions
The HDF Group HDF5 — <= 2.1.1
Weakness (CWE)
CWESourceDescription
CWE-125 cna CWE-125 Out-of-bounds read
CWE-787 cna CWE-787 Out-of-bounds write
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.5 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U
References (1)
Back to overview