Hdfgroup
Vulnerability activity for Hdfgroup: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.5MediumJul 27, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-17574HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.
- 5.5MediumJul 27, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-17573A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
- 5.5MediumJul 27, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-17572Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.
- 6.5MediumJul 20, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-26199HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.
- 7.5HighJul 20, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-26197HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are cor
- 5.5MediumApr 10, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-29043HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.
- 7.8HighApr 9, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-34734HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.
- 7.8HighFeb 19, 2026Hdfgroup hdf5 Memory corruptionCVE-2026-26200HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixe
Top products
- hdf58 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.