Skip to content
Heist/ feed
Back to feed
Medium

HDF5 H5T__ref_mem_setnull Heap Buffer Overflow

Type: advisorySources: OSV

HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-29043
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 03:32 UTC · Revision 1

Source evidence

HDF5 H5T__ref_mem_setnull Heap Buffer Overflow

core-osv · Original source

Published 10 Apr 2026, 15:35 UTC

HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.

osv:CVE-2026-29043
Complete source record
{
  "id": "2bb2b6d49034f9a86b11b656fefbfeed5350b6791c59ced60f2836f89a18c6ea",
  "url": "https://osv.dev/vulnerability/CVE-2026-29043",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HDF5 H5T__ref_mem_setnull Heap Buffer Overflow",
    "summary": "HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow condition in the H5T__ref_mem_setnull method. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems.",
    "evidence": "osv:CVE-2026-29043",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-29043",
      "aliases": [
        "CVE-2026-29043",
        "GHSA-qm2m-5g5w-2277"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hdfgroup/hdf5",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "ac07382ca947de2b936204dc9d60ce9ac245a21f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.14.1-2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.14.1-2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "hdf5-1_14_1-2",
            "hdff5-1_14_0",
            "hdff5-1_14-_0",
            "hdf5-1_14_1",
            "1.14.1",
            "hdf5-1_13_0-rc6",
            "hdf5-1_13_0-rc5",
            "hdf5-1_13_0-rc4",
            "hdf5-1_13_0-rc3",
            "hdf5-1_13_0-rc2",
            "hdf5-1_13_0-rc1",
            "vms_last_support_trunk",
            "before_removing_mpiposix_vfd",
            "hdf5-1_9-start",
            "hdf5-1_8_0-beta5",
            "hdf5-1_8_0-beta4",
            "hdf5-1_8_0-beta3",
            "hdf5-1_8_0-beta2",
            "hdf5-1_8_0-beta1",
            "hdf5-1_8_0-alpha4",
            "hdf5-1_8_0-alpha3",
            "hdf5-1_8_0-alpha2",
            "before_removing_fphdf5",
            "before_removing_docs",
            "before_removing_tbbt_code",
            "before_signed_unsigned_changes",
            "hdf5-1_6_2",
            "hdf5-1_6_1",
            "hdf5-1_6_0",
            "hdf5-1_4_0",
            "hdf5-1_4_1",
            "hdf5-1_3_1",
            "hdf5-1_3_0",
            "hdf5-1_2_1",
            "hdf5-1_2_0beta",
            "hdf5-1_2_0-beta1-update2",
            "hdf5-1_2_0",
            "hdf5-1_0_1",
            "hdf5-1_0_0",
            "r1_1beta1",
            "hdf5-1_0_0-alpha2",
            "proto1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29043.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.435318593Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29043.json",
        "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-qm2m-5g5w-2277",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-29043"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-122"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29043.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-29043",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 509879,
  "published_at": "2026-04-10T15:35:51.682+00:00"
}