---
title: "HDFGroup HDF5 vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/hdfgroup/hdf5
type: product
description: "HDFGroup HDF5 has 151 published CVEs, 0 in CISA KEV and 106 with public exploits."
updated: 2026-11-03
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# HDFGroup HDF5 vulnerabilities

Vendor: [HDFGroup](https://radicalnotion.ai/vendor/hdfgroup)

- **Published CVEs:** 151
- **In CISA KEV:** 0
- **With a public exploit:** 106
- **With a patch:** 129
- **Average CVSS:** 7.0
- **First CVE:** 2016-11-18
- **Latest CVE:** 2026-11-03
- **Platforms:** linux

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 19 |
| High | 49 |
| Medium | 80 |
| Low | 3 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 43 |
| [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 33 |
| [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 18 |
| [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 12 |
| [CWE-369](https://radicalnotion.ai/cwe/cwe-369) | Divide By Zero | 9 |
| [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 6 |
| [CWE-120](https://radicalnotion.ai/cwe/cwe-120) | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 5 |
| [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 4 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2016 | 4 |
| 2017 | 5 |
| 2018 | 35 |
| 2019 | 5 |
| 2020 | 4 |
| 2021 | 0 |
| 2022 | 10 |
| 2023 | 3 |
| 2024 | 35 |
| 2025 | 27 |
| 2026 | 23 |

## Affected versions (top 34 of 118)

| Version | Kind | CVEs |
| --- | --- | --- |
| before\_removing\_docs | exact | 126 |
| before\_removing\_fphdf5 | exact | 126 |
| before\_removing\_tbbt\_code | exact | 126 |
| before\_signed\_unsigned\_changes | exact | 126 |
| hdf5-1\_0\_0 | exact | 126 |
| hdf5-1\_0\_0-alpha2 | exact | 126 |
| hdf5-1\_0\_1 | exact | 126 |
| hdf5-1\_2\_0 | exact | 126 |
| hdf5-1\_2\_0-beta1-update2 | exact | 126 |
| hdf5-1\_2\_0beta | exact | 126 |
| hdf5-1\_2\_1 | exact | 126 |
| hdf5-1\_3\_0 | exact | 126 |
| \< 1.14.4 | range | 32 |
| \<= 1.14.3 | range | 26 |
| 1.14.6 | range | 16 |
| 1.8.20 | range | 16 |
| \<= 1.10.3 | range | 10 |
| 1.10.4 | range | 9 |
| \<= 1.14.6 | range | 8 |
| 1.10.2 | range | 7 |
| 1.13.1-1 | range | 7 |
| \<= 2.3.0 | range | 6 |
| \<= 2.2.0 | range | 5 |
| \< 2.0.0 | range | 4 |
| 1.14.4 | patched | 32 |
| 2.2.0 | patched | 4 |
| 2.3.0 | patched | 4 |
| 2.0.0 | patched | 3 |
| 2.1.0 | patched | 2 |
| 1.14.1-2 | patched | 1 |
| 1.14.2 | patched | 1 |
| 1.14.4.2 | patched | 1 |
| 1.14.6 | patched | 1 |
| 2.1.1 | patched | 1 |

## CVEs (first 30 of 151, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-120758 | NULL Pointer Dereference in H5HL\_unprotect via Corrupted File | medium | 5.4 | No | No | Yes |
| CVE-2026-120757 | Heap Buffer Over-read via Non-Terminated Link Data in H5L\_\_extern\_traverse | medium | 6.9 | No | No | Yes |
| CVE-2026-120756 | Heap Buffer Over-read via Malformed Message Size in HDF5's H5O\_\_chunk\_deserialize | low | 1.9 | No | Yes | Yes |
| CVE-2026-120755 | Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter | medium | 4.7 | No | No | Yes |
| CVE-2026-120754 | Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter | low | 1.9 | No | No | Yes |
| CVE-2026-120689 | Uncontrolled Recursion in HDF5 H5B\_\_iterate\_helper() via Crafted File | medium | 4.3 | No | No | Yes |
| CVE-2026-106547 | HDF5 heap buffer overflow in H5VM\_array\_fill via crafted fill-value metadata | high | 8.5 | No | No | Yes |
| CVE-2026-19029 | HDF5 scale-offset filter heap buffer over-read via crafted chunk | medium | 6.8 | No | No | Yes |
| CVE-2026-92627 | Heap Use-After-Free in H5T\_\_conv\_f\_f | medium | 4.6 | No | No | Yes |
| CVE-2026-19028 | HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read | medium | 6.8 | No | Yes | Yes |
| CVE-2026-19027 | HDF5 out-of-bounds heap read in N-Bit filter decompression | medium | 6.9 | No | Yes | Yes |
| CVE-2026-19026 | Nbit filter NULL/short parameter-array dereference | medium | 6.8 | No | Yes | Yes |
| CVE-2026-19025 | HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open | medium | 6.8 | No | Yes | Yes |
| CVE-2026-19024 | HDF5 H5Pget\_fill\_value NULL Pointer Dereference via Malformed Fill Value Message | high | 8.2 | No | Yes | Yes |
| CVE-2026-19023 | HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets | medium | 6.8 | No | Yes | Yes |
| CVE-2026-17574 | NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag | medium | 5.2 | No | No | Yes |
| CVE-2026-17573 | Double Free in H5D\_\_chunk\_copy() in HDF5 via a Crafted Chunk-Index Size Field | medium | 4.0 | No | Yes | Yes |
| CVE-2026-17572 | HDF5 SOHM List Index Heap Buffer Overflow | medium | 5.5 | No | No | Yes |
| CVE-2026-26199 | Buffer underflow in \`H5Iget\_name \`/\`H5G\_get\_name\` if size is zero | medium | 5.9 | No | Yes | Yes |
| CVE-2026-26197 | Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c | medium | 5.9 | No | Yes | Yes |
| CVE-2026-29043 | HDF5 H5T\_\_ref\_mem\_setnull Heap Buffer Overflow | medium | 5.5 | No | Yes | No |
| CVE-2026-34734 | HDF5: H5T\_\_conv\_struct Use After Free | high | 7.8 | No | Yes | Yes |
| CVE-2026-26200 | HDF5 Affected by H5T\_\_conv\_struct\_opt Heap Buffer Overflow | high | 7.8 | No | Yes | Yes |
| CVE-2025-7069 | HDF5 H5FSsection.c H5FS\_\_sect\_link\_size heap-based overflow | medium | 4.8 | No | Yes | No |
| CVE-2025-7068 | HDF5 H5FL.c H5FL\_\_malloc memory leak | medium | 4.8 | No | Yes | Yes |
| CVE-2025-7067 | HDF5 H5FScache.c H5FS\_\_sinfo\_serialize\_node\_cb heap-based overflow | medium | 4.8 | No | Yes | Yes |
| CVE-2025-6858 | HDF5 H5Centry.c H5C\_\_flush\_single\_entry null pointer dereference | medium | 4.8 | No | Yes | Yes |
| CVE-2025-6857 | HDF5 H5Gnode.c H5G\_\_node\_cmp3 stack-based overflow | medium | 4.8 | No | Yes | Yes |
| CVE-2025-6856 | HDF5 H5FL.c H5FL\_\_reg\_gc\_list use after free | medium | 4.8 | No | Yes | Yes |
| CVE-2025-6818 | HDF5 H5Ochunk.c H5O\_\_chunk\_protect heap-based overflow | medium | 4.8 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does HDFGroup HDF5 have?

HDFGroup HDF5 has 151 published CVE records since 2016.

### How many HDFGroup HDF5 CVEs are in CISA KEV?

None of HDFGroup HDF5's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for HDFGroup HDF5 vulnerabilities?

Yes — 106 of HDFGroup HDF5's CVEs have a known public exploit.

### Which versions of HDFGroup HDF5 are affected?

118 distinct HDFGroup HDF5 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in HDFGroup HDF5 CVEs?

HDFGroup HDF5's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write), CWE-476 (NULL Pointer Dereference).

### How many critical HDFGroup HDF5 vulnerabilities are there?

HDFGroup HDF5 has 19 critical and 49 high-severity CVEs.

### What is the average severity of HDFGroup HDF5 CVEs?

The average CVSS base score across HDFGroup HDF5's scored CVEs is 7.0.

## Other products from this vendor

- [HDF5 1.14.6](https://radicalnotion.ai/vendor/hdfgroup/hdf5-1-14-6) (1 CVEs)
- [Scale-Offset Filter](https://radicalnotion.ai/vendor/hdfgroup/scale-offset-filter) (1 CVEs)
- [Szip Filter](https://radicalnotion.ai/vendor/hdfgroup/szip-filter) (1 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/hdfgroup/hdf5). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.