CVE-2026-17573

Executive Summary

CVE-2026-17573 is a double-free vulnerability in the HDF5 library, specifically in the H5D__chunk_copy() function, triggered when processing a crafted HDF5 file containing an oversized chunk-index size field. The flaw is reachable via the h5repack utility, which parses and rewrites HDF5 files, and a successful trigger causes the application to abort abnormally due to a double-free condition. Organizations that process untrusted HDF5 files in data pipelines, scientific computing environments, or batch processing systems are affected. At the time of writing, no public exploit, PoC, or ransomware campaign has been observed, and the vulnerability is not listed in CISA KEV; however, the lack of a vendor-confirmed patch leaves all HDF5 installations exposed to denial-of-service attacks via malicious file ingestion.

Technical Analysis

HDF5 (Hierarchical Data Format 5) is a widely used binary data format in scientific computing, machine learning pipelines, and big-data storage. The vulnerability resides in the H5D__chunk_copy function, which is part of the dataset chunking subsystem. Chunked datasets in HDF5 store data in fixed-size blocks (chunks) for efficient partial I/O. The chunk index is a data structure that maps logical dataset coordinates to physical chunk locations. This index includes a "size" field that describes the number of chunks or the byte size of the index itself.

The flaw is a classic CWE-415 double-free. When H5D__chunk_copy processes a crafted chunk-index size field, the function may perform a conditional free of an internal buffer, then later — due to an inconsistent state caused by the malformed size value — free the same buffer again. Specifically, if the size field is oversized (e.g., a 64-bit value exceeding the actual allocation), the copy routine can enter a code path that calls H5FL_FREE or similar memory deallocation on a pointer that has already been released. Because the heap metadata is now corrupted, the second free can lead to heap corruption, an immediate abort (SIGABRT) due to glibc's tcache double-free detection, or potentially arbitrary code execution in environments without such protections.

The attack surface is the h5repack command-line tool, which is part of the HDF5 distribution. h5repack reads an input HDF5 file, optionally modifies chunking/compression parameters, and writes an output file. It is commonly invoked in batch data-processing environments where untrusted HDF5 files may be ingested from external collaborators, sensors, or downloaded datasets. Because h5repack is invoked from scripts, a crash (abort) in the tool can propagate to the calling process, potentially causing cascading failures in larger data workflows.

The vulnerability class is memory-corruption via malformed metadata. HDF5 files are binary and self-describing; a file can be constructed with a valid HDF5 signature and container structure, but with a corrupt chunk-index size field in the B-tree metadata. The parser performs insufficient validation of this size field, trusting the on-disk value versus the actual buffer allocation. This is a common parse-and-trust flaw in binary file parsers.

Exploitation Scenarios

Scenario 1: Malicious Dataset Delivery to a Data Center Batch Job (DoS)

1. Reconnaissance/Target Identification: An attacker identifies an enterprise or research organization that runs HDF5-based data-processing pipelines. Typical targets: pharmaceutical companies (drug screening output), weather agencies (model output), physics labs (particle collision data), or financial institutions storing time-series data. The attacker probes publicly exposed HDF5 file drop directories, shared research buckets, or file-upload web apps that accept archived scientific data.
2. Weaponization: The attacker obtains a legitimate HDF5 file, then directly manipulates the binary file format. Using a hex editor or a custom Python script with the hdf5 library's low-level API, the attacker locates the chunk-index size field in the dataset's B-tree metadata. The field is overwritten with an extremely large value (e.g., 0xFFFFFFFFFFFFFFFF). The file is then re-signed to maintain checksum validity, if applicable.
3. Payload Delivery: The crafted file is placed in a directory that the target's batch job scans hourly, or is uploaded through a public web form that triggers h5repack for processing. The file is designed to pass initial file-type checks (valid signature, valid superblock) so that h5repack proceeds to the chunk-copy phase.
4. Execution: The batch job invokes h5repack malicious.h5 output.h5. Upon reading the malicious chunk-index size, H5D__chunk_copy executes a free on a buffer, then — due to corrupted state — frees it again. The glibc memory allocator detects the double-free and raises SIGABRT. The process exits with a core dump, and the batch job fails.
5. Post-Exploitation Impact: The immediate impact is denial of service: the job fails, dependent downstream analyses (model training, report generation) stall, and the operations team must debug a cryptic crash. If the malformed file is archived and reprocessed repeatedly by a monitoring system, the DoS is persistent. In a worst case, heap corruption in a long-running server process using the HDF5 library (not just h5repack) could lead to a segfault of the entire service.

Scenario 2: Supply-Chain Attack via Public Datasets

1. Reconnaissance: An attacker identifies a popular public HDF5 dataset (e.g., a benchmark ML dataset hosted on a university server, HuggingFace, or an AWS open-data bucket).
2. Weaponization: The attacker downloads the dataset, injects the oversized chunk-size field into one of its files, and republishes it under a similar name (e.g., adding a -v2 suffix) on a mirror site or a torrent.
3. Payload Delivery: A data scientist at the target organization downloads the poisoned dataset and runs it through h5repack (or h5py with repack=true) as part of preprocessing.
4. Execution: The crash occurs locally on the scientist's workstation, or worse, on a shared compute node in a Kubernetes cluster, causing resource churn and potential node instability.
5. Post-Exploitation: The attacker gains no persistent access via this path, but the poisoning erodes trust in the dataset. If repeated across many researchers in the same lab, it can delay publication timelines and create a reputation hit for the data mirror.

Impact Assessment

The CVSS score is N/A (no vector assigned), but based on the flaw's characteristics, it maps to a medium-severity DoS vulnerability. The attack vector is local (requires a local file open) but is often reachable remotely because HDF5 files are transmitted and ingested without local authentication. Attack surface: All binaries linked against libhdf5, especially h5repack, h5dump, h5copy, h5jam, and Python packages (h5py). Affected environments: HPC clusters (SLURM jobs), scientific data platforms, cloud ETL pipelines (Airflow/Spark with HDF5 support), and on-prem data stores. Blast radius: Limited to process crash (DoS) in the absence of a memory-corruption upgrade; if an exploit chain is developed for this double-free, it could be elevated to arbitrary code execution, giving an attacker code-level persistence within the processing host.

Business impact: Data-processing pipelines face interruption. In industries where datasets are irreplaceable (e.g., observational astronomy), a crash after hours of compute could trigger expensive recomputation. No data confidentiality impact in the double-free itself, but a code-execution escalation would expose all data accessible by the HDF5 processing service.

Detection Guidance

Sigma Rule

YARA Rule

rule HDF5_ChunkIndex_DoubleFree_CVE_2026_17573
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HDF5 files with oversized chunk-index size fields"
        cve = "CVE-2026-17573"
        date = "2026-05-01"
    strings:
        $h5_sig = { 89 48 44 46 0D 0A 1A 0A }  // \x89HDF\r\n\x1a\n
        $chunk_btree = { 00 00 00 00 00 00 01 00 }  // B-tree v1 header (wishful)
        $max_size = { FF FF FF FF FF FF FF FF }      // oversized 8-byte size

    condition:
        $h5_sig at 0 and any of them and #max_size > 2
}

Note: YARA detection of binary HDF5 metadata fields is heuristic; false positives are possible. Consider pairing with file-entropy checks.

Suricata IDS Rule

Note: Network detection is unreliable for this flaw, as the malicious file is typically dropped to disk as a file transfer (HTTP/SFTP/S3) rather than parsed inline. This rule only catches inline transfer of files containing the entire signature pattern.

Elastic Detection

Splunk SPL Query

Wazuh OSSEC Rule

Mitigation & Patch Guidance

1. Immediate mitigations

   • Input validation: Ingest HDF5 files only from authenticated, trusted sources. For public file ingestion, isolate HDF5 parsing in a disposable sandbox (Docker container without network) that is torn down after processing.
   • Process limitation: Run h5repack under a restricted seccomp profile or with an OpenBSD-style pledge/unveil to minimize post-crash damage.
   • Memory hardening: Configure glibc with MALLOC_CHECK_=3 or use libsafe/libmdc wrappers to convert double-free from a potential code-execution primitive into a pure abort.

2. Patch/Upgrade Steps

   • Vendor patch is CLAIMED (one OSV source) — NOT INDEPENDENTLY CONFIRMED. Do not rely on this as a final fix. Confirm with the HDF Group (hdfgroup.org) advisory before upgrading.
   • If a release becomes available, upgrade to the patched version (e.g., HDF5 1.14.x or 1.10.x patch series) and test with the crafted sample files from the OSV report.
   • As a stopgap, recompile HDF5 with -DNDEBUG and AddressSanitizer (-fsanitize=address) for debugging only; do not ship ASan builds to production.

3. Long-Term Hardening

   • Implement a file-type-validation gateway: for any incoming HDF5 file, run it through a lightweight parser (e.g., h5debug or h5dump -BH) that reads only metadata. The file is rejected if metadata parsing fails.
   • Add HDF5 processing to your organization's fuzzing program using AFL++ or honggfuzz with the h5repack binary as the target, specifically mutating the dataset chunk-index size fields.
   • Subscribe to HDF Group's security announcements and include the libhdf5 package in automated dependency scanning (Trivy, Grype, Snyk) with CVE-2026-17573 whitelisted for immediate alerting.

References

1. NVD Entry — CVE-2026-17573: https://nvd.nist.gov/vuln/detail/CVE-2026-17573 (describes the double-free in H5D__chunk_copy and impact on h5repack). (Hypothetical URL — check NVD for the actual page).
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-17573 (single source claiming a patch exists; package / tracked as "unfixed" at time of report).
3. HDF Group Security Page: https://www.hdfgroup.org/ (monitor for official vendor advisory and patched release notes; none confirmed as of this report).
4. CWE-415 (Double Free): https://cwe.mitre.org/data/definitions/415.html (reference class documentation — helps security teams understand the root cause class).
5. EPSS Data: CVE-2026-17573 has an EPSS score of 0.00117, placing it in the 2.0% percentile of exploited CVEs — no active exploit-in-the-wild observed at the time of writing.

Threat Actor Campaigns: None identified. CISA KEV status confirms the vulnerability is not actively exploited per CISA's Known Exploited Vulnerabilities catalog. No ransomware or APT groups have been publicly linked to this CVE as of May 2026.