CVE-2026-106547
High
Description
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
SeverityHigh
CVSS8.5
Exploit probability—
ProductHDF5
PublishedOct 6, 2026
First seenOct 6, 2026
Weakness typeCWE-122CWE-122
How to fix
Update
- The HDF Group HDF52.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| The HDF Group HDF5 | 1.10.0 ≤ v < 2.2.0 | 2.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.