CVE Program partner

HDFG

The HDF Group

API
CVEs, 365 days1212 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationThe HDF Group
RoleCNA
TypeOpen Source
Reports toredhat → mitre
ScopeAll HDF software including HDF5, HDF4, HSDS, HDFView.
Advisorieshttps://github.com/HDFGroup/hdf5/security/advisories

Latest CVEs · RSS

  • CVE-2026-106547 2026-10-06 · CVSS 8.5
    A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbi
  • CVE-2026-19029 2026-10-06 · CVSS 6.8
    A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application
  • CVE-2026-92627 2026-09-16 · CVSS 4.6
    A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-po
  • CVE-2026-19028 2026-08-05 · CVSS 6.8
    H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the
  • CVE-2026-19027 2026-08-05 · CVSS 6.9
    The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance
  • CVE-2026-19026 2026-08-05 · CVSS 6.8
    H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nel
  • CVE-2026-19025 2026-08-05 · CVSS 6.8
    H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank
  • CVE-2026-19024 2026-08-05 · CVSS 8.2
    NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value m
  • CVE-2026-19023 2026-08-05 · CVSS 6.8
    Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a vari
  • CVE-2026-17574 2026-07-27 · CVSS 5.2
    HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type fie
  • CVE-2026-17573 2026-07-27 · CVSS 4.0
    A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause t
  • CVE-2026-17572 2026-07-27 · CVSS 5.5
    Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (cra

All CVE Program partners