PT-2026-20919

CVE-2026-26200

Published

2026-01-01

Updated

2026-04-29

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 1.14.4-2

Description HDF5 is software used for managing data. An attacker controlling an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow. This can lead to a denial-of-service condition, and potentially remote code execution depending on exploitability against modern operating systems. The real-world exploitability of remote code execution is currently unknown.

Recommendations Update to version 1.14.4-2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-131: Incorrect Calculation of Buffer Size

CWE-787: Out-of-bounds Write

CWE-122: Heap-based Buffer Overflow