CVE-2026-26200: 
NixOS vulnerability analysis and mitigation

CVE-2026-26200 is a heap-based buffer overflow vulnerability in the HDF5 data management library, specifically in the H5T__conv_struct_opt function, triggered when parsing a maliciously crafted .h5 file. It affects all HDF5 versions prior to 1.14.4-2 (tested against 1.14.1-2 and earlier). The vulnerability was published on February 19, 2026, with the GitHub Security Advisory (GHSA-5p2m-j456-9mr2) published by the HDFGroup on February 14, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) leading to a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) in the H5T__conv_struct_opt method within H5Tconv.c. When HDF5 reads a dataset with a specially crafted compound datatype (e.g., containing a string member with an inflated STRSIZE value), the buffer allocated during type conversion in H5D__typeinfo_init_phase3 is undersized relative to the data being copied via memmove, resulting in a write past the end of the heap allocation. Exploitation requires an attacker to supply a malicious .h5 file that is subsequently parsed by a target application using the HDF5 library — the primary attack scenario involves coercing a user into opening the file with h5dump or a similar tool, though server-side processes that ingest attacker-controlled HDF5 files may be exploitable without user interaction. A public proof-of-concept ASAN crash reproducer is included in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation can cause a denial-of-service condition by crashing any application that parses the malicious .h5 file. Beyond DoS, the heap-based buffer overflow carries a theoretical risk of remote code execution, with high confidentiality, integrity, and availability impact scores — however, real-world RCE exploitability against modern operating systems with heap mitigations (ASLR, heap hardening) is currently unconfirmed. Applications and services that process user-supplied HDF5 files — common in scientific computing, data analytics, and research environments — are within the affected asset scope (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept crash reproducer (ASAN output with a base64-encoded malicious .h5 file) is included in the GitHub Security Advisory, demonstrating the heap overflow in h5dump. There is no evidence of active in-the-wild exploitation or weaponized exploit kits at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability (GitHub Advisory, Feedly).

1. Craft a malicious HDF5 file: Create or modify an .h5 file containing a compound dataset with a specially crafted member type — specifically, a string member (H5T_STRING) with an inflated STRSIZE value (e.g., 1,970,974 bytes) that causes the type conversion buffer to be allocated too small relative to the data to be copied. The PoC file is provided in base64-encoded, gzip-compressed form in the GitHub advisory.
2. Deliver the file to the target: Distribute the malicious .h5 file to a target user via email, file share, or web download, or upload it to a server-side service that processes HDF5 files automatically.
3. Trigger parsing: The target user opens the file with h5dump or another HDF5-consuming application, or the server-side process ingests the file. HDF5 begins reading the dataset and initializes type conversion buffers.
4. Trigger the overflow: During dataset read (H5D__read → H5T_convert → H5T__conv_struct_opt), memmove writes 1,970,980 bytes into a 1,971,008-byte heap buffer allocated at the wrong size, overflowing past the allocation boundary.
5. Achieve impact: At minimum, the application crashes (DoS). Depending on heap layout and OS mitigations, an attacker may attempt to leverage the out-of-bounds write for code execution by controlling heap metadata or adjacent allocations (GitHub Advisory).

• File System: Presence of unexpected or externally sourced .h5 files in directories processed by HDF5 applications; files with anomalously large compound datatype string member sizes.
• Process: Abnormal termination (crash/segfault) of h5dump or HDF5-linked applications; AddressSanitizer abort messages referencing H5T__conv_struct_opt in H5Tconv.c or memmove in sanitizer interceptors.
• Logs: Application crash logs or core dumps referencing H5T__conv_struct_opt, H5D__typeinfo_init_phase3, or H5Dread; OS-level crash reports (e.g., dmesg segfault entries) tied to HDF5 processes.
• Network: Unexpected inbound transfers of .h5 files to servers running HDF5-based services; outbound connections from HDF5 service processes following file parsing (potential post-exploitation indicator) (GitHub Advisory).

Upgrade HDF5 to version 1.14.4-2 or later, which contains the fix for this vulnerability. Until patching is feasible, restrict processing of .h5 files to trusted, validated sources only, and avoid exposing HDF5 parsing functionality to untrusted user input. Running HDF5 applications in sandboxed or containerized environments with restricted privileges can limit the blast radius of exploitation. Monitor for unexpected crashes in HDF5-linked applications as a detection measure (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher denandz and disclosed via the HDFGroup's GitHub Security Advisory program. Red Hat tracked the issue via Bugzilla (Bug 2441088) and assigned it high severity/priority. Brief social media mentions appeared on Mastodon and Bluesky via @thehackerwire shortly after disclosure, and INCIBE-CERT published an early warning advisory. Community reaction has been measured, consistent with the limited active exploitation risk and the niche but important user base of HDF5 in scientific and data-intensive computing environments (GitHub Advisory, Red Hat Bugzilla).