CVE-2026-17574

Executive Summary

CVE-2026-17574 is a NULL pointer dereference vulnerability in the HDF5 data library, affecting all versions with no confirmed fix currently available. An attacker can craft a malicious HDF5 file containing an attribute with an invalid variable-length datatype type tag, causing a NULL pointer dereference when the attribute is processed, leading to a denial-of-service (DoS) condition. The vulnerability is server-side when HDF5 is used in web services or data processing pipelines, and client-side in desktop analysis tools, with the primary impact being application crashes and service disruption.

Technical Analysis

The vulnerability resides in the HDF5 library's handling of variable-length (vlen) datatypes. In HDF5, datatypes are described by a type tag that distinguishes between fixed-size and variable-length data. The library's internal representation of a vlen datatype uses a structure that includes a pointer to a base type descriptor (hvl_t or similar internal structure). When parsing an attribute from a file, the library validates the type tag but fails to check if the resulting datatype pointer is NULL under specific malformed input conditions.

The root cause is a missing NULL check in the type resolution logic. When an attribute is read, HDF5 calls a function to convert the stored type information into an in-memory datatype descriptor. For variable-length types, if the type tag is invalid (e.g., a reserved value or an out-of-range enumeration), the type resolution function returns a NULL pointer instead of a valid descriptor. Subsequent code paths dereference this NULL pointer when determining the size or layout of the attribute data, leading to a segmentation fault.

The attack surface is any application that reads untrusted HDF5 files. This includes scientific computing platforms (e.g., Python h5py, MATLAB), geospatial data processing tools, and web services that accept HDF5 uploads. The vulnerability is triggered entirely by file parsing, requiring no special runtime privileges beyond those of the processing application.

Attack vector analysis:

• Local exploitation: A user opens a malicious .h5 file in HDFView, h5py, or MATLAB. The application crashes, potentially corrupting unsaved work or crashing an upstream data processing pipeline.
• Remote exploitation: In web-based systems that ingest HDF5 files (e.g., data lakes, cloud analytics platforms), an attacker uploads the malformed file. The backend process crashes, causing a 500 error or full container restart depending on orchestration.
• Chained exploitation: If the HDF5 parsing library is linked into a long-running service with a worker pool (e.g., Celery tasks), repeated submissions can exhaust worker processes, creating a sustained DoS condition.

The vulnerability is classified as CWE-476 (NULL Pointer Dereference). The CVSS score is N/A due to incomplete vendor data; however, based on the attack vector (local file parsing or remote file upload) and impact (availability only), an estimated score would be in the moderate range. The EPSS score of 0.00117 places it in the 2.0 percentile, indicating low current exploitation activity, but this should not be interpreted as low risk for systems that process high volumes of untrusted HDF5 files.

Exploitation Scenarios

Attack chain for remote web-service exploitation:

1. Reconnaissance: The attacker identifies a web application that accepts HDF5 file uploads. This could be a scientific data repository, machine learning data pipeline, or IoT analytics platform. The attacker confirms through HTTP response headers or API documentation that the backend uses .h5 or .hdf5 format.

2. Weaponization: The attacker crafts a malicious HDF5 file. Using the h5py library, they programmatically create a valid HDF5 file, then manually corrupt the datatype type tag in an attribute. Specifically:

   # Python snippet to craft the file
   import h5py
   import numpy as np
   
   with h5py.File('malicious.h5', 'w') as f:
       # Create a dataset
       ds = f.create_dataset('data', data=np.array([1.0, 2.0, 3.0]))
       # Create an attribute with a vlen datatype
       attr = ds.attrs.create('malicious_attr', data=np.array([1.0, 2.0]), dtype=h5py.vlen_dtype(np.float64))
       # Corrupt the type tag after creation by binary patching
       # Locate the attribute's vlen datatype message and set the type tag byte to 0xFF
   

   The attacker then hex-edits the file to overwrite the vlen type tag byte at the correct offset (identifiable via the HDF5 format specification, specifically the Datatype message header where the class field for vlen is located).

3. Delivery: The attacker uploads the malicious file via the web form or API endpoint. No authentication bypass is needed if upload is anonymous or default credentials exist.

4. Trigger: The backend service parses the file to extract the attribute. When the parser encounters the corrupted vlen type tag, the type resolution function returns NULL. The subsequent size calculation dereferences this NULL pointer.

5. Post-exploitation: The backend worker process crashes. In a containerized environment, the container restarts, temporarily disrupting service for all users. If the service lacks proper error handling, the main application thread may crash entirely, requiring manual restart. The attacker can repeat this to achieve persistent DoS. While no code execution is achieved, the crash can corrupt in-memory buffers in shared libraries, potentially affecting other data processing tasks running in the same process.

Impact Assessment

The primary impact is denial-of-service. An attacker causing a crash in the HDF5 parsing library will interrupt scientific workflows, data processing pipelines, and analytics services.

• Business impact: For organizations running HDF5-based data services, a single malicious file can take down a production service. Financial impact includes SLA breaches, downtime costs, and potential loss of queued data processing jobs.
• Affected systems: All systems linking against HDF5 — scientific computing clusters, geospatial analysis tools, machine learning data preprocessing, and Internet-of-Things (IoT) data aggregation points.
• Blast radius: Local desktop users lose unsaved work; server-side services experience availability loss. In shared cluster environments, a crash may also affect other jobs sharing the same node if the library is linked into a shared memory space.
• CVSS subscores: No CVSS vector available. However, based on the vulnerability class and typical attack vectors, the confidentiality and integrity impact are none, availability impact is high. The attack complexity is low (requires file upload or local file open), the privileges required are none, and user interaction is required in local scenarios.

Given the EPSS score of 0.00117, the vulnerability is unlikely to be exploited in mass automated campaigns but remains a targeted risk. The absence of CISA KEV listing means no government-backed exploitation has been confirmed to date.

Detection Guidance

Sigma Rule

YARA Rule

Suricata IDS Rule

Note: This rule detects HDF5 file uploads in HTTP traffic. For file-level detection in SMB/FTP/NFS traffic, adjust the protocol and file signature contexts accordingly.

Elastic Detection

Alternative file-level detection using Sysmon FileCreate for shared file paths:

Splunk SPL Query

For web-based detection:

Wazuh OSSEC Rule

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

The OSV database references a patch for this vulnerability, but it has not been independently verified against the HDF Group's official release channel. Verify against the HDF Group's official release notes before trusting any update.

1. Immediate mitigations (until a verified patch is available):

   • Apply strict file validation before processing HDF5 files: validate file structure, cap file size, and reject files exceeding expected dimensions.
   • Run HDF5 parsing in sandboxed containers or isolated processes (via subprocess isolation or gVisor) to prevent cache crashes from bringing down the host service.
   • Limit upload endpoints to authenticated, trusted users if possible.
   • Add file hash allowlisting for known-good HDF5 files in production pipelines.

2. Patch/upgrade steps:

   • Monitor the HDF Group's official release page (https://github.com/HDFGroup/hdf5/releases) for a 1.14.x patch release.
   • When available, upgrade to the patched version: $ pip3 install --upgrade h5py for Python bindings, or rebuild from source for C/C++ dependencies.
   • If the OSV-referenced patch is published via a distro-specific channel (e.g., Debian, Ubuntu, RHEL), apply the backported security update once the fix is verified.
   • After patching, run your HDF5 test suite with the provided regression test to confirm the NULL pointer check is exercised.

3. Long-term hardening:

   • Enable stack canaries and ASLR on HDF5 binaries (default on modern compilers) to mitigate any potential memory corruption extensions.
   • Implement application-level exception handling wrappers around all HDF5 API calls to catch SIGSEGV and log the initiating filename for forensic purposes.
   • Add runtime monitoring to flag repeated crashes within a short time window in web-facing services.
   • Document this CVE in your vulnerability management tracker and schedule re-assessment after the patch is verified.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-17574 — Official CVE description, no CVSS score assigned yet.
2. CVE Record (MITRE): https://www.cve.org/CVERecord?id=CVE-2026-17574 — CNA title and affected product details.
3. HDF Group Official Site: https://www.hdfgroup.org — Official vendor site; monitor for security advisories and patch releases.
4. HDF5 Source Repository (GitHub): https://github.com/HDFGroup/hdf5 — Check commits and release notes for the claimed fix.
5. CWE-476 Reference: https://cwe.mitre.org/data/definitions/476.html — NULL Pointer Dereference weakness details.

Exploit-in-the-wild evidence: No known public exploitation campaigns or malware samples have been identified as of this report. The EPSS score of 0.00117 reflects low active exploitation. However, due to the prevalence of HDF5 in scientific and data-heavy industries, targeted attacks are plausible in environments where analysts routinely open files from untrusted sources (e.g., shared research repositories, third-party data vendors).