CVE-2026-26200

NameCVE-2026-26200
DescriptionHDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
hdf5 (PTS)bullseye1.10.6+repack-4+deb11u1undetermined
bookworm1.10.8+repack1-1undetermined
trixie1.14.5+repack-3undetermined
forky, sid1.14.6+repack-2undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
hdf5source(unstable)undetermined

Notes

https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5p2m-j456-9mr2
check details, said to be fixed in 1.14.4-2 upstream

Search for package or bug name: Reporting problems