CVE-2026-17574 — NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag

CVE-2026-17574

NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag PUBLISHED

Description (CNA)

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

Affected (CNA)

Vendor / product	Versions
The HDF Group / HDF5	affected <= 2.1.1

CWE

CWE-617, CWE-476

References

https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.