CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474	Exploit
https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc	Vendor Advisory
https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) HDF5 es una biblioteca de alto rendimiento y una especificación de formato de archivo que implementa el modelo de datos HDF5. Si se invoca a ’H5Iget_name’ en un ID de grupo con ’0’ para el parámetro de tamaño, se producirá un subdesbordamiento al intentar colocar un terminador nulo en el búfer. Esto puede ocurrir si se invoca a ’H5Iget_name’ de una manera donde ’size’ puede ser forzado a cero, y hay datos importantes antes del búfer ’name’.

Information

Published : 2026-07-20 16:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-26199

Mitre link : CVE-2026-26199

CVE.ORG link : CVE-2026-26199

JSON object : View

Products Affected

hdfgroup

hdf5

CWE

CWE-124

Buffer Underwrite ('Buffer Underflow')

{"id": "CVE-2026-26199", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26199", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T18:56:40.908924Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "HDFGroup", "product": "hdf5", "versions": [{"status": "affected", "version": "<= 1.14.6"}]}]}], "published": "2026-07-20T16:16:57.550", "references": [{"url": "https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-124"}]}], "descriptions": [{"lang": "en", "value": "HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer."}, {"lang": "es", "value": "HDF5 es una biblioteca de alto rendimiento y una especificaci\u00f3n de formato de archivo que implementa el modelo de datos HDF5. Si se invoca a \u2019H5Iget_name\u2019 en un ID de grupo con \u20190\u2019 para el par\u00e1metro de tama\u00f1o, se producir\u00e1 un subdesbordamiento al intentar colocar un terminador nulo en el b\u00fafer. Esto puede ocurrir si se invoca a \u2019H5Iget_name\u2019 de una manera donde \u2019size\u2019 puede ser forzado a cero, y hay datos importantes antes del b\u00fafer \u2019name\u2019."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B181E71-4481-43DE-BA4F-CE71C4A791DA", "versionEndExcluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}