CVE-2026-29043: 
NixOS vulnerability analysis and mitigation

CVE-2026-29043 is a heap-based buffer overflow vulnerability in the HDF5 data management library, specifically in the H5T__ref_mem_setnull method, triggered when parsing a maliciously crafted .h5 file. It affects HDF5 versions 1.14.1-2 and earlier. The vulnerability was published on April 10, 2026, and assigned a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787 / CWE-122) in the H5T__ref_mem_setnull function located in src/H5Tref.c, which is responsible for overwriting target buffers with null bytes during type conversion. When a specially crafted .h5 file is parsed — for example, via the h5dump or h5stat utilities — the function performs a memset write of 64 bytes into a 16-byte heap-allocated region, causing a heap buffer overflow. The vulnerability was discovered through fuzzing and requires user interaction (opening a malicious file) in the baseline scenario, though server-side deployments that automatically parse attacker-controlled .h5 files may be exploitable without user interaction. A complete PoC, including a base64-encoded gzip payload and AddressSanitizer output, is publicly available in the GitHub Security Advisory (GitHub Advisory).

The primary confirmed impact is denial of service — a crafted .h5 file can crash any application using the HDF5 library to parse it, including server-side data processing pipelines. Because the overflow writes null bytes out-of-bounds, the likelihood of achieving remote code execution is reduced but not eliminated; heap-based buffer overflows can theoretically be leveraged for RCE depending on the target OS and memory layout. There is no confidentiality or integrity impact identified in the current CVSS scoring (GitHub Advisory, Red Hat Bugzilla).

A functional proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a base64-encoded gzip payload that can be decoded and fed to h5dump to reproduce the heap buffer overflow. The EPSS score is approximately 0.04%, indicating low current probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detectable via Nessus plugin 306247 (GitHub Advisory, Feedly).

1. Craft or obtain the malicious h5 file: Use the published PoC payload — decode the base64-encoded gzip string from the GitHub advisory and decompress it to produce a malformed .h5 file: echo "<base64_payload>" | base64 -d | gunzip -c > malicious.h5
2. Deliver the file to the target: Social-engineer a user into opening the file with h5dump or another HDF5-consuming application, or upload it to a server-side service that automatically parses HDF5 files.
3. Trigger the overflow: The target application calls h5dump malicious.h5, which internally invokes H5T__ref_mem_setnull during type conversion, causing a 64-byte memset write into a 16-byte heap buffer.
4. Achieve denial of service: The out-of-bounds write corrupts heap memory, causing the application to crash (confirmed via AddressSanitizer output showing heap-buffer-overflow at H5Tref.c:394).
5. Potential RCE (advanced): In environments without modern heap mitigations, an attacker could attempt to manipulate heap layout to redirect execution flow, though this is considered low-likelihood due to the null-byte write nature of the overflow (GitHub Advisory).

• Process: Unexpected crashes or abrupt termination of processes invoking h5dump, h5stat, or any application linked against libhdf5 when processing externally supplied .h5 files.
• Logs: Application crash logs or core dumps referencing H5T__ref_mem_setnull in H5Tref.c or H5T__conv_ref in H5Tconv.c; AddressSanitizer output containing heap-buffer-overflow at the memset interceptor.
• File System: Presence of unexpected or externally sourced .h5 files in directories processed by HDF5-consuming services; core dump files generated by HDF5 utilities.
• Network: Unusual file uploads of .h5 content to services that parse HDF5 data server-side, particularly from untrusted or external sources (GitHub Advisory).

No patched version of HDF5 has been officially released as of the advisory publication date — the advisory lists "None" for patched versions, meaning all versions up to and including 1.14.1-2 remain affected. Recommended interim mitigations include: (1) avoid parsing .h5 files from untrusted sources; (2) run HDF5 file parsing in isolated sandboxed environments to limit blast radius; (3) validate and sanitize .h5 files before processing. Organizations should monitor the HDF5 GitHub repository for an official patch release and apply it promptly when available (GitHub Advisory, Red Hat Bugzilla).

Red Hat opened a security tracking bug (Bugzilla #2457327) classifying the issue as medium severity, with product security personnel assigned to assess impact on Red Hat products. The advisory was published by researcher denandz (credited as reporter) via the HDFGroup GitHub Security Advisory program. No significant broader media coverage or notable social media commentary has been identified beyond standard CVE aggregator coverage (Red Hat Bugzilla, GitHub Advisory).