Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-26199Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

Medium 5.9

In plain English

A medium-severity security flaw in hdf5 from HDFGroup. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	hdf5	no fix listed	DEBIAN-CVE-2026-26199
Debian:13	hdf5	no fix listed	DEBIAN-CVE-2026-26199
Debian:14	hdf5	no fix listed	DEBIAN-CVE-2026-26199
Ubuntu:22.04:LTS	hdf5	no fix listed	UBUNTU-CVE-2026-26199
Ubuntu:24.04:LTS	hdf5	no fix listed	UBUNTU-CVE-2026-26199
Ubuntu:26.04:LTS	hdf5	no fix listed	UBUNTU-CVE-2026-26199
Ubuntu:26.10	hdf5	no fix listed	UBUNTU-CVE-2026-26199

Affected products (as reported)

Vendor	Product	Versions
HDFGroup	hdf5	<= 1.14.6

Weakness: CWE-124 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc x_refsource_CONFIRM
https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474 x_refsource_MISC