CVE-2026-34734

HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj	Exploit Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34734
https://bugzilla.redhat.com/show_bug.cgi?id=2457034
https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj	Exploit Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34734.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HDF5 es un software para gestionar datos. En 1.14.1-2 y versiones anteriores, se encontró un uso después de liberación en el heap en la utilidad auxiliar h5dump. Un atacante que pueda proporcionar un archivo h5 malicioso puede desencadenar un uso después de liberación en el heap. El objeto liberado es referenciado en una llamada a memmove desde H5T__conv_struct. El objeto original fue asignado por H5D__typeinfo_init_phase3 y liberado por H5D__typeinfo_term.

Information

Published : 2026-04-09 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34734

Mitre link : CVE-2026-34734

CVE.ORG link : CVE-2026-34734

JSON object : View

Products Affected

hdfgroup

hdf5

CWE

CWE-416

Use After Free

CWE-825

Expired Pointer Dereference

{"id": "CVE-2026-34734", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34734", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-13T20:47:34.523913Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "HDFGroup", "product": "hdf5", "versions": [{"status": "affected", "version": "<= 1.14.1-2"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "hdf5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-09T20:16:25.437", "references": [{"url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-34734", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457034", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34734.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term."}, {"lang": "es", "value": "HDF5 es un software para gestionar datos. En 1.14.1-2 y versiones anteriores, se encontr\u00f3 un uso despu\u00e9s de liberaci\u00f3n en el heap en la utilidad auxiliar h5dump. Un atacante que pueda proporcionar un archivo h5 malicioso puede desencadenar un uso despu\u00e9s de liberaci\u00f3n en el heap. El objeto liberado es referenciado en una llamada a memmove desde H5T__conv_struct. El objeto original fue asignado por H5D__typeinfo_init_phase3 y liberado por H5D__typeinfo_term."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8B60376-0798-400E-9C01-184EE73C4A51", "versionEndExcluding": "1.14.1-2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}