HDF5: Heap-based buffer overflow in fill value handling
Summary
HDF5, a library for scientific data files, contains a heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c. When unallocated chunks of a dataset are read, the fill value buffer is built from metadata in the file; if that metadata is inconsistent, the library writes past the end of the buffer. An attacker who can supply a crafted HDF5 file may cause a crash and possibly execute arbitrary code, and controls the written content through the stored fill value. The CVSS vector requires local access and user interaction, so the realistic path is a malicious file opened by a user or application.
Affected
- HDF5 1.10.0 up to, but not including, 2.2.0 (CNA record)
- Distribution packages: affected builds vary; verify with the distribution's tracker. Unknown.
Fixed in
- HDF5 2.2.0 (fix version per CNA record, OpenCVE and VulDB)
- The HDF Group's 2.2.0 announcement mentions three security fixes, but the excerpt reviewed does not name this CVE. Unverified.
- Fixed builds in individual distributions: Unknown.
Workaround
- No vendor-documented workaround known.
- Do not open HDF5 files from unknown or untrusted sources.
- Process untrusted files in an isolated container or VM with limited rights.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept found in the research; re-check before relying on this.
Our recommendation
- Inventory systems and applications that bundle HDF5 (for example libhdf5, h5py, vendor analysis tools).
- Upgrade to HDF5 2.2.0 or to a distribution build confirmed to contain the fix.
- Until patched, restrict processing of HDF5 files from third parties.
- Check the vendor or distribution advisory before assuming a fix.
- Priority: medium; raise to high where HDF5-based tools process external files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HDF5 pull request #6529 (linked in CVE record) github.com
- VulDB CVE-2026-106547 vuldb.com
- VulDB vulnerability 414616 vuldb.com
- OSV Debian entry CVE-2026-106547 osv.dev
- Vulners Red Hat entry CVE-2026-106547 vulners.com
- HDF Group release announcement HDF5 2.2.0 www.hdfgroup.org
- HDF Group HDF5 security policy github.com
- OpenCVE CVE-2026-106547 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:17.
Original description (NVD)
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.