Log in Start free

Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M

CVE-2026-26200HDF5 Affected by H5T__conv_struct_opt Heap Buffer Overflow

High 7.8

In plain English

A high-severity heap buffer overflow in hdf5 from HDFGroup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12hdf5no fix listedDEBIAN-CVE-2026-26200
Debian:13hdf5no fix listedDEBIAN-CVE-2026-26200
Debian:14hdf5no fix listedDEBIAN-CVE-2026-26200
Ubuntu:22.04:LTShdf5no fix listedUBUNTU-CVE-2026-26200
Ubuntu:24.04:LTShdf5no fix listedUBUNTU-CVE-2026-26200
Ubuntu:25.10hdf5no fix listedUBUNTU-CVE-2026-26200
Ubuntu:26.04:LTShdf5no fix listedUBUNTU-CVE-2026-26200
Ubuntu:26.10hdf5no fix listedUBUNTU-CVE-2026-26200

Affected products (as reported)

VendorProductVersions
HDFGroup hdf5 < 1.14.4-2

Weakness: CWE-122, CWE-131 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References