CVE catalog
CVE-2026-106547
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. Whe
- Severity
- High · CVSS 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.16% · Oct 25, 2026
A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | hdf5 | sid | 2.2.0+repack-5 | vulnerable |
| Debian | hdf5 | forky | 2.2.0+repack-5 | vulnerable |
| Debian | hdf5 | trixie | 1.14.5+repack-3 | vulnerable |
| Debian | hdf5 | bookworm | 1.10.8+repack1-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | hdf5 | source | sid | (unfixed) | unimportant | Not reported | Not reported |
| Debian | hdf5 | source | forky | (unfixed) | unimportant | Not reported | Not reported |
| Debian | hdf5 | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | hdf5 | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [hdf5-helpers]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [hdf5-tools]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-103]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-103-1]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-cpp-103]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-cpp-103-1]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-dev]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-doc]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· all · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· all · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-fortran-102]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-hl-100]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-hl-cpp-100]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-hl-fortran-100]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-java]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· all · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· all · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-jni]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-103]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-103-1]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-cpp-103-1]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-dev]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-fortran-102]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
- [libhdf5-mpich-hl-100]Affected
Source package: [hdf5]
Details (2)
1.10.8+repack1-1· amd64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
1.10.8+repack1-1· arm64 · bookwormAffected
nvd · hdf5 · debian · bookworm; nvd · hdf5 · debian · 12
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-106547]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-106547]
- [https://security-tracker.debian.org/tracker/CVE-2026-106547]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106547.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]