CVE-2024-29162

What it actually does

Stack buffer overflow in the H5HG_read function of the HDF5 library allows out-of-bounds writes on the stack when processing specially crafted global heap data.

Why it matters to the business

Applications that parse untrusted HDF5 files may crash or allow arbitrary code execution, disrupting scientific computing, data analytics, and storage workflows that rely on the library.

How an attack unfolds

An attacker crafts a malicious HDF5 file containing oversized global heap data that overflows the stack buffer inside H5HG_read; the file is opened by a vulnerable application, triggering the overflow that can lead to denial of service or remote code execution.

How to fix it

Upgrade HDF5 to a version newer than 1.13.3 and 1.14.2 that contains the fix for the H5HG_read buffer overflow; rebuild dependent applications against the patched library.

How to confirm the fix worked

Confirm installed HDF5 version is newer than 1.13.3/1.14.2; run regression tests with known trigger files and monitor for crashes or memory errors in H5HG_read.

Typical attack path

1. Identify target applications that consume HDF5 files
2. Craft a malicious HDF5 file triggering overflow in H5HG_read
3. Deliver the file via email, download, or shared storage
4. Victim application opens the file and executes H5HG_read
5. Overflow occurs leading to crash or code execution

How to detect it

Search application and system logs for segmentation faults or crashes originating from HDF5 library functions during file parsing; inspect process dumps for stack corruption near global heap handling.

• H5HG_read
• stack buffer overflow in global heap
• HDF5 heap data parsing crash

What your security team should do

• Prioritize patching HDF5 in all environments that process external files
• Inventory applications and containers using vulnerable HDF5 versions
• Implement file-type sandboxing or validation before parsing untrusted HDF5 content
• Monitor EPSS and exploit maturity updates for this CVE