https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:23:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106547 <p>A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset&#39;s unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer&#39;s allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.</p> <p>A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset&#39;s unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer&#39;s allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106547 https://vulnerability.circl.lu/vuln/ghsa-p24g-8x6r-2v93 <p>A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset&#39;s unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer&#39;s allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.</p> <p>A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset&#39;s unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer&#39;s allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file.</p> https://vulnerability.circl.lu/vuln/ghsa-p24g-8x6r-2v93