CVE-2026-17572

Executive Summary

CVE-2026-17572 is a heap-based buffer overflow vulnerability in the HDF5 library (through version 2.1.1) affecting the SOHM (Shared Object Header Message) list-index deserialization code. A crafted HDF5 file with a maliciously declared num_messages count exceeding list_max triggers out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum. The vulnerability affects all platforms and can be triggered when a victim opens a malicious HDF5 file, leading to denial of service via process crash or potentially arbitrary memory corruption. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and currently has no public exploit, no CISA KEV listing, and a minimal EPSS score of 0.00119, indicating low active exploitation likelihood.

Technical Analysis

The HDF5 library (Hierarchical Data Format 5) implements a caching mechanism for shared object header messages (SOHMs). These messages allow multiple dataset/group headers to reference shared metadata, reducing file size and improving I/O performance. The metadata cache (H5SM__cache_list_deserialize) is responsible for reading the SOHM list index from disk and reconstructing the in-memory cache structure.

The vulnerability resides in the deserialization logic that processes the "list index" portion of the SOHM cache entry. When a file on disk declares a num_messages field (the number of shared messages expected in the list), the deserialization routine allocates or determines buffer boundaries based on this value. However, the code fails to validate that num_messages is within the bounds of list_max — the maximum number of messages that the heap-allocated list buffer can physically accommodate.

Specifically, within H5SM__cache_list_deserialize, the following sequence occurs:

1. The file's SOHM list-index header is read, including num_messages (an unsigned integer declaring message count).
2. The routine attempts to iterate over num_messages entries, reading each message header from the file.
3. Memory for the in-memory list is allocated based on list_max (derived from the file's superblock extension or computed constants). If num_messages > list_max, the iteration reads and writes beyond the end of the heap-allocated buffer.
4. The subsequent checksum verification routine, H5SM__cache_list_verify_chksum, similarly iterates over the same out-of-bounds region to compute checksums, causing further heap over-reads.

The root cause is an integer/bounds validation gap: num_messages is attacker-controlled via the file format and is trusted without cross-checking against the allocated buffer capacity. This is a classic case of a missing bounds check before a heap buffer access — the CWE-125 classification (out-of-bounds read) covers the over-read component, though out-of-bounds writes are also present in the same code path.

Attack surface: Any application that links against HDF5 and parses untrusted HDF5 files is vulnerable. This includes scientific computing tools (e.g., h5dump, h5py in Python, MATLAB, ParaView, VTK), data pipelines, and any web service that ingests user-uploaded HDF5 files for processing. The vulnerability is file-based (local attack vector), but remote exploitation is possible via file upload endpoints, email attachments, or network share access.

The affected code is part of the HDF5 metadata cache layer, which is exercised during file open/read operations — no special user interaction beyond opening the file is required. The crash manifests as a SIGSEGV during heap corruption detection or during checksum computation.

Exploitation Scenarios

Prerequisite Note: This is a file-parsing vulnerability requiring the victim to open a malicious HDF5 file. The success of exploitation relies on a social engineering step to deliver the file (e.g., email attachment, download link, uploaded file on a web application).

Step 1 — Reconnaissance/Target Identification: The attacker identifies targets that process HDF5 files. In research/academic environments, this includes data analysis platforms (e.g., web portals for genomic data, climate data repositories, or engineering analysis tools). The attacker also scans for publicly accessible file-upload endpoints (e.g., via Shodan dork product:HDF5 or by probing common API endpoints like /upload on research portals) that accept .h5/.hdf5 files.

Step 2 — Malicious File Crafting: The attacker constructs a valid HDF5 file using the h5py Python library or the h5cc compiler with custom binary editing. The steps to create the malicious file are:

# Crafting script (conceptual)
import h5py
import numpy as np

# Create a valid HDF5 file with shared message lists
f = h5py.File('malicious.h5', 'w')
dset = f.create_dataset('data', data=np.random.rand(100,100))
# Force creation of shared object header messages
f.create_dataset('shared1', data=np.random.rand(10))
f.create_dataset('shared2', data=np.random.rand(10))
f.close()

The attacker then hex-edits the file to locate the SOHM list-index metadata block and patches the num_messages field. Specifically, the field is located within the file's metadata cache records (signature SOHM or SMSG depending on version). The attacker overrides the 4-byte num_messages value to a large number (e.g., 0xFFFFFFFF or a value > 100,000), far exceeding the actual list_max allocation.

Step 3 — File Delivery / Trigger: The attacker delivers the file via:

• Email attachment to a scientist using HDF5-based tools.
• Upload to a web application that calls H5Fopen on uploaded files (e.g., a data visualization service, a Jupyter notebook server, or an ETL pipeline).
• Placing the file on a shared network drive that automated HDF5-based processing tools monitor.

When the victim opens the file (e.g., h5dump malicious.h5, h5py.File('malicious.h5','r'), or MATLAB's h5info), the HDF5 library reads the SOHM list-index metadata and enters H5SM__cache_list_deserialize.

Step 4 — Payload Execution / Corruption: The deserialization loop iterates num_messages times. Each iteration:

• Reads message header fields from the file (out-of-bounds read from the heap buffer if num_messages > list_max).
• Writes parsed message pointers/metadata into the heap list buffer beyond its allocated boundary (out-of-bounds write).

This corrupts adjacent heap metadata (glibc's chunk headers, other active allocations). The corruption typically results in an immediate crash when the application later calls free() or malloc() on corrupted chunks, triggering malloc_printerr (double-free/consolidation error). In hardened scenarios (ASLR, PIE), a full code-execution chain is difficult but not impossible — the attacker could attempt heap grooming to overlap allocated structures with function pointers, though no public PoC demonstrates successful RCE.

Post-Exploitation Impact:

• Denial of Service: Most common outcome — crash of the consuming application. If the target is a web service, repeated uploads of malicious files can cause persistent service interruption (reboot loops, cascading crashes in worker processes).
• Data Corruption: If the process survives partial corruption, out-of-bounds writes may modify other in-memory data structures, leading to incorrect scientific calculations or corrupted output files.
• Potential Code Execution: (Theoretical, no public evidence) If the heap layout can be groomed, the attacker could overwrite function pointers in adjacent objects. However, HDF5's complex object model and modern FORTIFY_SOURCE protections make this an unlikely near-term outcome without specific version research.

Impact Assessment

Business Impact: HDF5 is widely embedded in scientific and engineering software stacks. Organizations relying on HDF5 for data analysis pipelines, research publication workflows, or customer-facing data services face reputational and operational risk. A successful exploit results in application crashes, unprocessed data batches, and potential data integrity issues. For regulated industries (pharmaceutical research, aerospace engineering), corrupted HDF5 output could contaminate compliance-sensitive data.

Affected Systems: All HDF5 versions through 2.1.1 across Windows, Linux, macOS. Specific affected products include:

• The HDF5 C library itself (libhdf5)
• Python h5py (bundles libhdf5)
• MATLAB's HDF5 interface
• ParaView, VTK, and related visualization tools
• OPeNDAP and similar data-serving platforms

Blast Radius: Medium. The vulnerability requires user interaction (opening a file). CVSS v3.1 scoring (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 5.5 Medium) reflects that the attack vector is local, user interaction is required, and the primary impact is denial of service (availability). The confidentiality and integrity subscores are None because no data exfiltration or direct file modification is documented; only heap memory corruption is triggered.

Detection Guidance

Sigma Rule

YARA Rule

Suricata IDS Rule

Note: This rule is limited — it assumes the malicious HDF5 file is transferred over the network (HTTP upload, SMB, FTP). Detection relies on file-upload ingress filtering. The 0xFFFFFFFF pattern represents the overridden num_messages field — this is a conservative match since legitimate files rarely contain this exact value in SOHM metadata.

Elastic Detection

Alternative signature-based approach:

Splunk SPL Query

For Linux application-level detection:

Wazuh OSSEC Rule

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed).

1. Immediate Mitigations (until official patch is available):

• Restrict HDF5 file ingestion: If your application accepts HDF5 uploads via web services, add file-content validation that parses the SOHM metadata before processing. Reject files where num_messages fields are inconsistent with actual message data.
• Sandboxing: Run HDF5 processing in isolated containers (Docker, gVisor) or via chroot/seccomp to limit the crash blast radius. A crash in a sandboxed worker is far less disruptive than a crash in a primary service.
• Disable shared message list support by setting the environment variable HDF5_USE_FILE_LOCKING=FALSE and configuring the library with --disable-shared during compilation (if building from source), though this may not be feasible for binary distributions.
• Monitor for anomaly: Enable AddressSanitizer (ASAN) builds of HDF5 in development/testing to detect and report the specific overflow pattern before it reaches production.

2. Patch/Upgrade Steps:

• Monitor the HDF Group website (https://support.hdfgroup.org/releases/) and the OSV database for the official advisory and patched release (expected version 2.1.2 or later).
• When the patch is released, upgrade:
  • HDF5 C library to >= patched version.
  • Recompile applications linking statically against libhdf5.a.
  • Update Python environments: pip install --upgrade h5py (h5py bundles its own libhdf5 — verify version with h5py.version.hdf5_version).
  • For Debian/Ubuntu: monitor for DSA/USN security notices.
• Verify the patch resolves the issue by testing against a crafted file with num_messages > list_max using ASAN builds.

3. Long-Term Hardening:

• Static analysis integration: Add HDF5 to your CI/CD pipeline with CodeQL or Semgrep rules that detect missing bounds checks in deserialization code.
• Input validation layers: Implement an HDF5 file fuzzing harness in your QA process (using libFuzzer or AFL++) to catch future deserialization flaws.
• EOL version tracking: Replace embedded HDF5 versions older than 2.0.0 with maintained releases; many security fixes have landed since 1.8.x.
• Network filtering: Deploy IDS rules (like the Suricata rule above) on ingress gateways to flag HDF5 file transfers containing anomalous SOHM metadata.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-17572
2. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. HDF Group Release Notices: https://support.hdfgroup.org/releases/ — monitor for upcoming advisory
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-17572 NOT listed (verified as of report date)

Threat Actor Campaigns: No known campaigns exploiting CVE-2026-17572 have been identified as of this writing. The EPSS score (0.00119, 2.1st percentile) indicates negligible in-the-wild exploitation probability. No vulnerability broker (e.g., Zero Day Initiative) has published research on this CVE. The confirmed status is limited to the vendor's internal fix claim via OSV; independent confirmation from the HDF Group is pending.

Additional Context: HDF5 has a history of similar metadata-cache deserialization vulnerabilities (e.g., CVE-2018-17432, CVE-2020-10809), suggesting the SOHM code path continues to lack robust fuzzing coverage. Security teams should proactively fuzz HDF5 parsing in their environments while awaiting the official patch.