CVE-2026-26199: HDF5 Library Buffer Overflow Vulnerability

CVE-2026-26199 Overview

CVE-2026-26199 is an integer underflow vulnerability in HDF5, a high-performance library and file format specification implementing the HDF5 data model. The flaw resides in the H5Iget_name function within src/H5Gname.c. When H5Iget_name is invoked on a group identifier with a size parameter of 0, the code underflows while attempting to place a null terminator into the buffer. Attackers can trigger memory corruption if size can be forced to zero and important data resides before the name buffer. The vulnerability is tracked as CWE-124: Buffer Underwrite.

Critical Impact
Applications passing untrusted or attacker-controlled size values to H5Iget_name may experience memory corruption resulting in application crashes or availability impact on systems processing HDF5 files.

Affected Products

HDF5 library (The HDF Group)
Applications embedding HDF5 that call H5Iget_name with externally influenced size parameters
Scientific computing, HPC, and data analysis platforms relying on HDF5 for data storage

Discovery Timeline

2026-07-20 - CVE-2026-26199 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-26199

Vulnerability Analysis

The vulnerability stems from missing input validation on the size parameter passed to H5Iget_name. This function retrieves the name associated with an HDF5 object identifier and writes it into a caller-provided buffer. When the buffer size is zero, the null-terminator placement logic performs arithmetic that underflows, producing an out-of-bounds write before the intended buffer. The condition is classified under CWE-124 Buffer Underwrite, where writes occur prior to the start of the target buffer rather than past its end.

Exploitation requires an application to call H5Iget_name in a way where the size argument can reach zero through attacker influence. When adjacent memory before the name buffer contains security-relevant data, the underflow can corrupt that state.

Root Cause

The root cause is the absence of a lower-bound check on the size parameter before the null-terminator write in src/H5Gname.c. The referenced HDF5 source line shows where the length arithmetic reduces to an invalid index. Because size_t values wrap around at zero, decrementing to place '\0' produces a very large offset, causing a write outside the buffer.

Attack Vector

The attack requires user interaction and high attack complexity. An adversary must supply a crafted HDF5 workflow or induce a downstream application to invoke H5Iget_name with size = 0 on a group identifier. Successful exploitation impacts availability by corrupting adjacent memory. See the GitHub Security Advisory GHSA-5c6x-jmgf-f5vc for the maintainer analysis.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-26199

Indicators of Compromise

Unexpected crashes or aborts in processes linked against the HDF5 library when opening or traversing group identifiers
Memory corruption signatures reported by AddressSanitizer or Valgrind referencing H5Iget_name or H5Gname.c
Anomalous HDF5 file processing failures on data pipelines that accept externally supplied HDF5 inputs

Detection Strategies

Perform static analysis of application code that calls H5Iget_name to identify call sites where the size argument derives from untrusted input
Run fuzzing campaigns against HDF5 consumers with malformed group identifiers and zero-length buffer parameters
Inventory installed HDF5 library versions across build systems, containers, and HPC clusters using software composition analysis

Monitoring Recommendations

Monitor process crashes, segmentation faults, and abnormal exits in scientific computing and data-processing workloads that ingest HDF5 files
Track HDF5 package versions across endpoints and servers to detect unpatched installations
Log and alert on ingestion of HDF5 files originating from untrusted sources into analysis pipelines

How to Mitigate CVE-2026-26199

Immediate Actions Required

Update to the patched HDF5 release referenced in GHSA-5c6x-jmgf-f5vc as soon as it is available for your platform
Audit application source code for H5Iget_name call sites and validate that the size parameter is always greater than zero before invocation
Restrict HDF5 file ingestion to trusted sources until patched libraries are deployed

Patch Information

The HDF Group has published a security advisory at GHSA-5c6x-jmgf-f5vc with remediation details. Rebuild dependent applications against the corrected library and redeploy to production systems. Verify updated version strings in build manifests and container images.

Workarounds

Wrap calls to H5Iget_name in a guard that rejects or short-circuits when size == 0
Sanitize any externally supplied buffer size arguments before passing them into HDF5 API functions
Isolate HDF5 processing in sandboxed environments or containers with strict resource and memory protections to limit blast radius

bash

# Example guard pattern for callers of H5Iget_name
if (size == 0) {
    return -1; // Refuse zero-size buffer before invoking H5Iget_name
}
result = H5Iget_name(group_id, name_buffer, size);