{"kind": "product", "path": "vulns/ubuntu-26.10/hdf5", "name": "hdf5", "product": "hdf5", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-106547", "noindex": false, "published": "2026-10-06T20:14:41.443Z", "modified": "2026-10-07T15:11:20.673Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106547", "title": "HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata", "description": "A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.", "references": ["https://github.com/HDFGroup/hdf5/pull/6529", "https://nvd.nist.gov/vuln/detail/CVE-2026-106547"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19029", "noindex": false, "published": "2026-10-06T20:01:36.340Z", "modified": "2026-10-07T16:05:28.833Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19029", "title": "HDF5 scale-offset filter heap buffer over-read via crafted chunk", "description": "A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.", "references": ["https://github.com/HDFGroup/hdf5/pull/6718", "https://nvd.nist.gov/vuln/detail/CVE-2026-19029"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-92627", "noindex": false, "published": "2026-09-16T15:16:54.160Z", "modified": "2026-09-17T17:36:14.708Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00229, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-92627", "title": "Heap Use-After-Free in H5T__conv_f_f", "description": "A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory", "references": ["https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption", "https://nvd.nist.gov/vuln/detail/CVE-2026-92627"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19028", "noindex": false, "published": "2026-08-05T23:15:09.580Z", "modified": "2026-10-06T20:32:52.600Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00195, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19028", "title": "HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read", "description": "H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.", "references": ["https://github.com/HDFGroup/hdf5/pull/6497", "https://github.com/HDFGroup/hdf5/issues/6488", "https://github.com/HDFGroup/hdf5/issues/6490"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19027", "noindex": false, "published": "2026-08-05T23:12:20.658Z", "modified": "2026-10-06T20:33:19.385Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00195, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19027", "title": "HDF5 out-of-bounds heap read in N-Bit filter decompression", "description": "The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5\nprior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.", "references": ["https://github.com/HDFGroup/hdf5/pull/6497", "https://github.com/HDFGroup/hdf5/issues/6489", "https://github.com/HDFGroup/hdf5/issues/6492"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19026", "noindex": false, "published": "2026-08-05T22:47:58.227Z", "modified": "2026-10-06T20:32:13.006Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00195, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19026", "title": "Nbit filter NULL/short parameter-array dereference", "description": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.", "references": ["https://github.com/HDFGroup/hdf5/pull/6497", "https://github.com/HDFGroup/hdf5/issues/6489", "https://github.com/HDFGroup/hdf5/issues/6492"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19025", "noindex": false, "published": "2026-08-05T22:35:11.510Z", "modified": "2026-08-06T14:34:46.492Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19025", "title": "HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open", "description": "H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.", "references": ["https://github.com/HDFGroup/hdf5/issues/6491", "https://nvd.nist.gov/vuln/detail/CVE-2026-19025"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19024", "noindex": false, "published": "2026-08-05T22:14:29.792Z", "modified": "2026-08-06T15:30:56.798Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.00185, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19024", "title": "HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message", "description": "NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the \"defined\" flag set together with a negative size field, which is not normalized to the library's \"undefined\" sentinel and reaches H5T_path_find with a NULL datatype.", "references": ["https://github.com/HDFGroup/hdf5/issues/6487", "https://nvd.nist.gov/vuln/detail/CVE-2026-19024"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-19023", "noindex": false, "published": "2026-08-05T22:13:45.859Z", "modified": "2026-08-06T15:30:38.112Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00172, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19023", "title": "HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets", "description": "Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.", "references": ["https://github.com/HDFGroup/hdf5/issues/6486", "https://nvd.nist.gov/vuln/detail/CVE-2026-19023"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-17574", "noindex": false, "published": "2026-07-27T15:12:18.767Z", "modified": "2026-07-27T18:36:55.399Z", "cvss": 5.2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17574", "title": "NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag", "description": "HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.", "references": ["https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc", "https://nvd.nist.gov/vuln/detail/CVE-2026-17574"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-17573", "noindex": false, "published": "2026-07-27T15:11:54.655Z", "modified": "2026-07-27T17:27:00.732Z", "cvss": 4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17573", "title": "Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field", "description": "A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.", "references": ["https://github.com/HDFGroup/hdf5/issues/6124", "https://nvd.nist.gov/vuln/detail/CVE-2026-17573"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-17572", "noindex": false, "published": "2026-07-27T15:11:36.949Z", "modified": "2026-07-27T18:37:34.393Z", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:U", "severity": "medium", "epss": 0.00141, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-17572", "title": "HDF5 SOHM List Index Heap Buffer Overflow", "description": "Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.", "references": ["https://github.com/HDFGroup/hdf5/issues/6501", "https://nvd.nist.gov/vuln/detail/CVE-2026-17572"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-26199", "noindex": false, "published": "2026-07-20T14:59:35.038Z", "modified": "2026-07-20T18:56:52.113Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-26199", "title": "Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero", "description": "HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.", "references": ["https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc", "https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474", "https://nvd.nist.gov/vuln/detail/CVE-2026-26199"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-26197", "noindex": false, "published": "2026-07-20T14:55:50.636Z", "modified": "2026-07-20T15:34:11.301Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-26197", "title": "Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c", "description": "HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size  are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are corrupted so that they don't align with the others (element size * nelem = full size), it can lead to an out of bounds read. Depending on what is corrupt", "references": ["https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f", "https://nvd.nist.gov/vuln/detail/CVE-2026-26197"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-29043", "noindex": false, "published": "2026-04-10T15:35:51.682Z", "modified": "2026-04-14T14:50:46.566Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00213, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-29043", "title": "HDF5 H5T__ref_mem_setnull Heap Buffer Overflow", "description": "HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.", "references": ["https://github.com/HDFGroup/hdf5/security/advisories/GHSA-qm2m-5g5w-2277", "https://nvd.nist.gov/vuln/detail/CVE-2026-29043"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-34734", "noindex": false, "published": "2026-04-09T19:01:21.794Z", "modified": "2026-07-15T01:04:04.102Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34734", "title": "HDF5: H5T__conv_struct Use After Free", "description": "HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term.", "references": ["https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj", "https://access.redhat.com/security/cve/CVE-2026-34734", "https://bugzilla.redhat.com/show_bug.cgi?id=2457034"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-26200", "noindex": false, "published": "2026-02-19T19:19:10.512Z", "modified": "2026-07-15T01:15:09.607Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00419, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-26200", "title": "HDF5 Affected by H5T__conv_struct_opt Heap Buffer Overflow", "description": "HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.", "references": ["https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5p2m-j456-9mr2", "https://access.redhat.com/security/cve/CVE-2026-26200", "https://bugzilla.redhat.com/show_bug.cgi?id=2441088"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-7069", "noindex": false, "published": "2025-07-04T21:02:06.876Z", "modified": "2025-07-08T13:38:56.989Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-7069", "title": "HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow", "description": "A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.", "references": ["https://vuldb.com/?id.314904", "https://vuldb.com/?ctiid.314904", "https://vuldb.com/?submit.602538"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-7068", "noindex": false, "published": "2025-07-04T20:32:06.420Z", "modified": "2025-07-08T13:56:18.646Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-7068", "title": "HDF5 H5FL.c H5FL__malloc memory leak", "description": "A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.", "references": ["https://vuldb.com/?id.314903", "https://vuldb.com/?ctiid.314903", "https://vuldb.com/?submit.602537"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-7067", "noindex": false, "published": "2025-07-04T18:02:05.802Z", "modified": "2025-07-08T13:57:09.724Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-7067", "title": "HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflow", "description": "A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.", "references": ["https://vuldb.com/?id.314902", "https://vuldb.com/?ctiid.314902", "https://vuldb.com/?submit.602536"], "fixes": [], "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}]}], "total": 45, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "hdf5", "path": "vulns/ubuntu-26.10/hdf5", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-07T16:05:28.833Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}