Vulnerability · Published Jul 27, 2026 · Assigned by HDFG
CVE-2026-17572HDF5 SOHM List Index Heap Buffer Overflow
Medium 5.5
In plain English
A medium-severity out-of-bounds read in HDF5 from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-17572 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-17572 |
| Debian:14 | hdf5 | 2.2.0+repack-1 | DEBIAN-CVE-2026-17572 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-17572 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-17572 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-17572 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-17572 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | HDF5 | <= 2.1.1 |
Weakness: CWE-125, CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U