Source: hdf5 Version: 1.14.6+repack-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for hdf5. CVE-2026-26197[0]: | HDF5 is a high-performance library and a file format specification | that implements the HDF5 data model. If a file is corrupted such | that an array datatype's size, the number of elements, and the | element size are not in agreement it can trigger an out of bounds | read. The array datatype stores the full size of the datatype | (`dt->shared->size`) separately from the number of elements | (`dt->shared->u.array.nelem`) and the element size | (`dt->shared->parent->shared->size`). If any one of these are | corrupted so that they don't align with the others (element size * | nelem = full size), it can lead to an out of bounds read. Depending | on what is corrupted, it can alter the type of out of bounds read | triggered. The vulnerability is present only in files that have been | maliciously altered, as its generally not possible to independently | alter the full size of the datatype, the element count and the | element size. As such, this is only present if a malicious actor is | altering files, and won't appear in regular usage. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-26197 https://www.cve.org/CVERecord?id=CVE-2026-26197 [1] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f [2] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
