Vulnerability · Published Oct 6, 2026 · Assigned by HDFG
CVE-2026-106547HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
High 8.5
In plain English
A high-severity heap buffer overflow in HDF5 from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-106547 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-106547 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-106547 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:22.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:24.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:26.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-106547 |
| Ubuntu:26.10 | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-106547 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | HDF5 | 1.10.0 – before 2.2.0 |
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N