CVE-2026-34734 HDFGroup CVE debrief

Who should care

Organizations using HDF5 version 1.14.1-2 or earlier should prioritize patching this vulnerability. The vulnerability can be exploited by a local attacker with no privileges required. Successful exploitation can lead to high impact on confidentiality, integrity, and availability.

Technical summary

The vulnerability is caused by a heap-use-after-free issue in the h5dump helper utility of HDF5. The issue arises when a malicious h5 file is supplied, triggering a use-after-free error in the H5T__conv_struct function. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high severity vulnerability.

Defensive priority

Patching is strongly recommended. Organizations should update HDF5 to a version that fixes this vulnerability. In the absence of a patch, defenders can consider monitoring for suspicious activity related to h5dump and restricting access to untrusted h5 files.

Recommended defensive actions

• Patch HDF5 to a version that fixes the vulnerability
• Restrict access to untrusted h5 files
• Monitor for suspicious activity related to h5dump
• Implement compensating controls to detect and prevent exploitation
• Perform thorough inventory checks to identify affected systems

Evidence notes

The vulnerability was reported by an unknown source and details are based on NVD and GitHub security advisories. The CVE record and NVD detail pages provide additional information on the vulnerability. However, due to limited evidence, the full scope of affected systems and potential impact is not clear.

Official resources