PT-2026-61600 · Hdf5 · Hdf5

CVE-2026-26199 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions HDF5 (affected versions not specified)

Description HDF5 is a high-performance library and file format specification. An integer underflow occurs when the H5Iget name() function is called on a group id with the size parameter set to 0 while attempting to place a null terminator in the buffer. This issue can be triggered if the size variable is forced to zero and critical data exists before the name buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-124

Related Identifiers

CVE-2026-26199

GHSA-5C6X-JMGF-F5VC

Affected Products

Hdf5

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26199.json · Exploit
• 🔥 https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26199 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26199 · Vendor Advisory
• https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474 · Note
• https://twitter.com/infoflowcloud/status/2079240282537607334 · Twitter Post
• https://twitter.com/CVEnew/status/2079238931736822053 · Twitter Post