Heap-Based Buffer Overflow in HDF5 Affects Remote Applications

CVE-2026-106547

What is CVE-2026-106547?

A heap-based buffer overflow flaw in HDF5 can be exploited by an attacker who crafts a malicious HDF5 file. This vulnerability arises within the H5VM_array_fill() function in src/H5VM.c, where improper handling of dataset metadata leads to a potential application crash or execution of arbitrary code. Specifically, if the metadata for datatype and dataspace is inconsistent with the allocated buffer size, the function may write beyond the buffer's boundaries, allowing an attacker to control the fill value stored in the file and manipulate application behavior.

References