CVE-2026-17574CWE-476CWE-617

CVE-2026-17574

Medium · published July 27, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Weaknesses
CWE-476 · NULL Pointer Dereference; CWE-617 · Reachable Assertion
Published
2026-07-27T20:17Z
Affected products (1)
ProductVersionsFixed in
hdfgroup/hdf5< 2.1.12.1.1
References (1)
https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc · 0253b833-3e77-4dfe-9d57-17db1a2f0a74
EPSS history
Timeline
  • 27 JUL 15:12Z
    NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag
    cvelistv5