HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc Vendor Advisory
- https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.9 · hdfgroupNVD modified 2026-10-24 20:10
Affected (CPE criteria) 1
cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*