CVE-2026-17573CWE-415

CVE-2026-17573

Medium · published July 27, 2026

CVSS v3.1

5.5

EPSS

Percentile

3.9

In the wild

Unconfirmed

What it is

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00151 · 3.9th percentile
Weakness: CWE-415 · Double Free
Published: 2026-07-27T20:17Z

Affected products (1)

Product	Versions	Fixed in
hdfgroup/hdf5	< 2.2.0	2.2.0

References (2)

https://github.com/HDFGroup/hdf5/issues/6124 · 0253b833-3e77-4dfe-9d57-17db1a2f0a74 https://github.com/HDFGroup/hdf5/issues/6124 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

27 JUL 15:11Z
Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
cvelistv5