Heap Use After Free Vulnerability in HDF5 Software by HDF Group

CVE-2026-34734

What is CVE-2026-34734?

The HDF5 software, a widely-used tool for managing and storing large datasets, has a vulnerability due to a heap use-after-free condition found in the h5dump utility. This occurs when an attacker supplies a specially crafted HDF5 file, enabling them to trigger the flaw during a memmove operation. The vulnerability arises when the freed object is erroneously referenced, potentially leading to unintended actions or access within the application's memory. The affected versions include HDF5 1.14.1 and earlier, emphasizing the need for users to implement security best practices and update to safer versions.

References