CVE-2026-34734

{
  "id": "CVE-2026-34734",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T20:16:25.437",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-free. The freed object is referenced in a memmove call from H5T__conv_struct. The original object was allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term."
    },
    {
      "lang": "es",
      "value": "HDF5 es un software para gestionar datos. En 1.14.1-2 y versiones anteriores, se encontró un uso después de liberación en el heap en la utilidad auxiliar h5dump. Un atacante que pueda proporcionar un archivo h5 malicioso puede desencadenar un uso después de liberación en el heap. El objeto liberado es referenciado en una llamada a memmove desde H5T__conv_struct. El objeto original fue asignado por H5D__typeinfo_init_phase3 y liberado por H5D__typeinfo_term."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HDFGroup",
          "product": "hdf5",
          "versions": [
            {
              "version": "<= 1.14.1-2",
              "status": "affected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "hdf5",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T20:47:34.523913Z",
          "id": "CVE-2026-34734",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-825"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.14.1-2",
              "matchCriteriaId": "D8B60376-0798-400E-9C01-184EE73C4A51"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-34734",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457034",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://github.com/HDFGroup/hdf5/security/advisories/GHSA-w7v2-9cmr-pwwj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34734.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}