CVE-2026-106547: HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
A heap-based buffer overflow in H5VMarrayfill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5Dfillinit() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
Affected Software
Event History
Frequently Asked Questions
Which versions are affected?
HDF5 versions before 2.2.0 are affected. The provided information does not identify specific fixed maintenance releases other than 2.2.0.
What must an attacker do to trigger the flaw?
An attacker must cause an application using a vulnerable HDF5 version to read a crafted HDF5 file. Exploitation occurs when the application reads unallocated dataset chunks whose fill-value metadata is inconsistent with the allocated fill-value buffer size.
What is the potential impact on an affected application?
The crafted file can cause an application crash and may permit arbitrary code execution. The attacker controls the fill-value content that is written past the end of the heap buffer.