CVE-2026-17572

Severity CVSS v4.0:

MEDIUM

Type:

CWE-125 Out-of-bounds Read

Publication date:

27/07/2026

Last modified:

27/07/2026

Description

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.

Impact

Vector 4.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U CVSS v4.0 Severity and Metrics:

Base Score: 5.50 MEDIUM
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U

Attack Vector (AV): Local
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): None
User Interaction (UI): Active
Confidentiality (VC): None
Integrity (VI): Low
Availability (VA): High
Confidentiality (SC): None
Integrity (SI): Low
Availability (SA): High
Exploit Maturity (E): Unreported

Base Score 4.0

5.50

Severity 4.0

MEDIUM

References to Advisories, Solutions, and Tools

https://github.com/HDFGroup/hdf5/issues/6501