CVE-2026-17573

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/HDFGroup/hdf5/issues/6124	Exploit Issue Tracking Third Party Advisory
https://github.com/HDFGroup/hdf5/issues/6124	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de doble liberación fue descubierta en la biblioteca HDF5. Procesar un archivo HDF5 manipulado que contiene un campo de tamaño de fragmento sobredimensionado a través de h5repack puede causar que la aplicación aborte debido a una doble liberación.

Information

Published : 2026-07-27 16:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-17573

Mitre link : CVE-2026-17573

CVE.ORG link : CVE-2026-17573

JSON object : View

Products Affected

hdfgroup

hdf5

CWE

CWE-415

Double Free

{"id": "CVE-2026-17573", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17573", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:26:40.305274Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "affectedData": [{"vendor": "The HDF Group", "product": "HDF5", "versions": [{"status": "affected", "version": "<= 2.1.1", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T16:17:04.807", "references": [{"url": "https://github.com/HDFGroup/hdf5/issues/6124", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6124", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free."}, {"lang": "es", "value": "Una vulnerabilidad de doble liberaci\u00f3n fue descubierta en la biblioteca HDF5. Procesar un archivo HDF5 manipulado que contiene un campo de tama\u00f1o de fragmento sobredimensionado a trav\u00e9s de h5repack puede causar que la aplicaci\u00f3n aborte debido a una doble liberaci\u00f3n."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C6C6E30-3E4B-4CCD-837E-64FA485D25EA", "versionEndExcluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}