CVE-2026-29043

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node's level matches the expected level, allowing a crafted HDF5 file to bypass the check and cause unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file.

In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.

The HDF5 1.8.16 library has a vulnerability that allows modification of the loop's index when initializing an array, potentially leading to out-of-bounds access. The value used for space allocation comes from the file, creating a risk of manipulation by an attacker.

The HDF5 library version 1.8.16 fails to check if certain message types support a particular flag, leading to casting the structure to an alternative structure and assigning values to fields not supported by the message type. This can result in code execution under the context of the library.

When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library fails to ensure that the precision is within the bounds of the size, leading to arbitrary code execution.

The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.

In HDF5 through version 2.2.0, there is a heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. An attacker can cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes.

A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0. A crafted HDF5 file can cause an application crash and possibly execute arbitrary code when unallocated chunks of a dataset are read and metadata is inconsistent with the buffer's allocated size.

HDF5 before version 1.14.2 contains a heap-use-after-free vulnerability in H5T__conv_f_f() in src/H5Tconv.c. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read within the same conversion routine.

HDF5 prior to 2.3.0 has a vulnerability in H5Z__filter_fletcher32 that computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.