CVE Watch15 jul 2026

CVE-2026-26200

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-b

CVSS

7.8

Alto

EPSS

0.4%

p29

KEV

—

Exploit Today

0-100

Publicado: 19 feb 2026 · Última mod.: 15 jul 2026 · CWE-122 · CWE-787 · CWE-131

EPSS · 30d

0.4%EPSS · 30 días0.4%

2026-08-202026-09-17

Descripción técnica

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-814777.2 ALT

—

——0Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.15h CVE-2026-814747.8 ALT

—

——0Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.16h CVE-2026-252807.8 ALT

1.5%

——0Memory corruption when processing escape handling flow with insufficient user buffer sizes.22h CVE-2026-240747.8 ALT

5.8%

——2Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.22h CVE-2026-240737.8 ALT

5.8%

——2Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.22h CVE-2026-927867.8 ALT

2.7%

——1LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.1d