DEBIAN-CVE-2026-26200

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-26200

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-26200.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-26200

Upstream

CVE-2026-26200

Published

2026-02-19T20:25:42.610Z

Modified

2026-02-20T10:20:49.960286Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-26200

Affected packages

Debian:11 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.6+repack-4

1.10.6+repack-4+deb11u1

1.10.6+repack-5

1.10.7+repack-1

1.10.7+repack-2

1.10.7+repack-3

1.10.7+repack-4

1.10.8+repack-1

1.10.8+repack-2

1.10.8+repack-3

1.10.8+repack-4

1.10.8+repack1-1

1.10.10+repack-1

1.10.10+repack-2

1.10.10+repack-3

1.10.10+repack-3.1

1.10.10+repack-3.2

1.10.10+repack-3.2+ports

1.10.10+repack-3.3

1.10.10+repack-4

1.10.10+repack-5

1.12.0+repack-1~exp1

1.12.0+repack-1~exp2

1.12.2+repack-1~exp1

1.14.3+repack-1~exp1

1.14.3+repack1-1~exp2

1.14.3+repack1-1~exp3

1.14.4.3+repack-1~exp1

1.14.4.3+repack-1~exp2

1.14.4.3+repack-1~exp3

1.14.5+repack-1~exp1

1.14.5+repack-1~exp2

1.14.5+repack-1~exp3

1.14.5+repack-1~exp4

1.14.5+repack-1~exp5

1.14.5+repack-1~exp6

1.14.5+repack-1

1.14.5+repack-2

1.14.5+repack-3~exp1

1.14.5+repack-3~exp2

1.14.5+repack-3~exp3

1.14.5+repack-3~exp4

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-26200.json"

Debian:12 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.10.8+repack1-1

1.10.10+repack-1

1.10.10+repack-2

1.10.10+repack-3

1.10.10+repack-3.1

1.10.10+repack-3.2

1.10.10+repack-3.2+ports

1.10.10+repack-3.3

1.10.10+repack-4

1.10.10+repack-5

1.12.0+repack-1~exp1

1.12.0+repack-1~exp2

1.12.2+repack-1~exp1

1.14.3+repack-1~exp1

1.14.3+repack1-1~exp2

1.14.3+repack1-1~exp3

1.14.4.3+repack-1~exp1

1.14.4.3+repack-1~exp2

1.14.4.3+repack-1~exp3

1.14.5+repack-1~exp1

1.14.5+repack-1~exp2

1.14.5+repack-1~exp3

1.14.5+repack-1~exp4

1.14.5+repack-1~exp5

1.14.5+repack-1~exp6

1.14.5+repack-1

1.14.5+repack-2

1.14.5+repack-3~exp1

1.14.5+repack-3~exp2

1.14.5+repack-3~exp3

1.14.5+repack-3~exp4

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-26200.json"

Debian:13 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-26200.json"

Debian:14 / hdf5

Package

Name: hdf5
Purl: pkg:deb/debian/hdf5?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.14.5+repack-3

1.14.5+repack-3.1

1.14.5+repack-4~exp1

1.14.5+repack-4~exp2

1.14.5+repack-4

1.14.5+repack-5~exp2

1.14.5+repack-5~exp3

1.14.6+repack-1~exp1

1.14.6+repack-1~exp2

1.14.6+repack-1~exp3

1.14.6+repack-1~exp4

1.14.6+repack-1~exp5

1.14.6+repack-1~exp6

1.14.6+repack-1~exp7

1.14.6+repack-1~exp8

1.14.6+repack-1~exp9

1.14.6+repack-1~exp10

1.14.6+repack-1~exp11

1.14.6+repack-1~exp12

1.14.6+repack-1~exp13

1.14.6+repack-1~exp14

1.14.6+repack-1~exp15

1.14.6+repack-1~exp16

1.14.6+repack-1~exp17

1.14.6+repack-1~exp18

1.14.6+repack-1~exp19

1.14.6+repack-1~exp20

1.14.6+repack-1~exp21

1.14.6+repack-1

1.14.6+repack-2

1.14.6+repack-3~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-26200.json"