CVE-2026-17572

Vulnerability Description

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.

Related Weaknesses (CWE)

CWE-787 CWE-125

References

https://github.com/HDFGroup/hdf5/issues/6501

FAQ

What is CVE-2026-17572?

CVE-2026-17572 is a documented vulnerability. Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared...

How severe is CVE-2026-17572?

CVSS scoring is not yet available for CVE-2026-17572. Check NVD for updates.

Is there a patch for CVE-2026-17572?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.