CVE Tools
Track your stack

HDF5

151 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for HDF5, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

HDF5 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
HDF5 CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-0312
2025-040
2025-052
2025-0610
2025-073
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-042
2026-050
2026-060
2026-075
2026-086
2026-091
2026-102
2026-116

Severity

How the 151 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1913%
  • High4935%
  • Medium5438%
  • Low1913%

Latest CVEs

The 15 most recently published vulnerabilities affecting HDF5.

  1. CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted File5.5
  2. CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse7.1
  3. CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize6.1
  4. CVE-2026-120755Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter5.5
  5. CVE-2026-120754Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter3.3
  6. CVE-2026-120689Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File—
  7. CVE-2026-106547HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata—
  8. CVE-2026-19029HDF5 scale-offset filter heap buffer over-read via crafted chunk—
  9. CVE-2026-92627Heap Use-After-Free in H5T__conv_f_f—
  10. CVE-2026-19028HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read—
  11. CVE-2026-19027HDF5 out-of-bounds heap read in N-Bit filter decompression—
  12. CVE-2026-19026Nbit filter NULL/short parameter-array dereference—
  13. CVE-2026-19025HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open—
  14. CVE-2026-19024HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message—
  15. CVE-2026-19023HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets—

Product grouping is registry-driven, with AI assist and human review. How it works