CVE-2026-26199 Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
A buffer underflow in HDF5 allows attackers to cause crashes or read sensitive memory when calling H5Iget_name with a zero size parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26199?
CVE-2026-26199 is a medium-severity vulnerability in Hdfgroup Hdf5, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.
Weakness: CWE-124
Which versions are affected by CVE-2026-26199?
It affects 1 product.
Products include Hdfgroup Hdf5.
How do I fix CVE-2026-26199?
Apply the vendor's patch.
Is CVE-2026-26199 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26199 exists.
Other vulnerabilities in Hdfgroup Hdf5
Sources
Also known as AZL-92850, DEBIAN-CVE-2026-26199, ECHO-e01e-70ff-c35f, GHSA-5c6x-jmgf-f5vc, JLSEC-2026-1163, UBUNTU-CVE-2026-26199.