CVE-2026-17574

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

Database specific

{
    "cna_assigner": "HDFG",
    "cwe_ids": [
        "CWE-476",
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17574.json"
}

References

Affected packages

Git / github.com/hdfgroup/hdf5

Affected ranges

Type

GIT

Repo

https://github.com/hdfgroup/hdf5

Events

Introduced

Fixed

3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other

before_removing_docs

before_removing_fphdf5

before_removing_mpiposix_vfd

before_removing_tbbt_code

before_signed_unsigned_changes

final_autotools_develop

hdf5-1_0_0

hdf5-1_0_0-alpha2

hdf5-1_0_1

hdf5-1_13_0-rc1

hdf5-1_13_0-rc2

hdf5-1_13_0-rc3

hdf5-1_13_0-rc4

hdf5-1_13_0-rc5

hdf5-1_13_0-rc6

hdf5-1_2_0

hdf5-1_2_0-beta1-update2

hdf5-1_2_0beta

hdf5-1_2_1

hdf5-1_3_0

hdf5-1_3_1

hdf5-1_4_0

hdf5-1_4_1

hdf5-1_6_0

hdf5-1_6_1

hdf5-1_6_2

hdf5-1_8_0-alpha2

hdf5-1_8_0-alpha3

hdf5-1_8_0-alpha4

hdf5-1_8_0-beta1

hdf5-1_8_0-beta2

hdf5-1_8_0-beta3

hdf5-1_8_0-beta4

hdf5-1_8_0-beta5

hdf5-1_9-start

proto1

r1_1beta1

snapshot

vms_last_support_trunk

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17574.json"

vanir_signatures

[
    {
        "target": {
            "file": "src/H5T.c"
        },
        "deprecated": false,
        "source": "https://github.com/hdfgroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc",
        "id": "CVE-2026-17574-0912f856",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "274921587343906571865884840214797699826",
                "218735433575158383455950150911036132485",
                "36064808215094242208768224637068369674"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "H5T_set_loc",
            "file": "src/H5T.c"
        },
        "deprecated": false,
        "source": "https://github.com/hdfgroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc",
        "id": "CVE-2026-17574-90a5aa84",
        "signature_version": "v1",
        "digest": {
            "length": 3136.0,
            "function_hash": "96636413968695097147669403978491293747"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "H5O__dtype_decode_helper",
            "file": "src/H5Odtype.c"
        },
        "deprecated": false,
        "source": "https://github.com/hdfgroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc",
        "id": "CVE-2026-17574-aa10fb47",
        "signature_version": "v1",
        "digest": {
            "length": 28359.0,
            "function_hash": "312917291809852612179395531208939565314"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/H5Odtype.c"
        },
        "deprecated": false,
        "source": "https://github.com/hdfgroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc",
        "id": "CVE-2026-17574-d731947e",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "72241723068773176422388129625625254912",
                "124297536161815367924935210825137214828",
                "186907295524257073945883995123335851795",
                "100324344415832817838716120491104348061"
            ]
        },
        "signature_type": "Line"
    }
]

vanir_signatures_modified

"2026-08-12T16:24:47Z"