CVE-2024-32620

What it actually does

Heap-based buffer over-read in H5F_addr_decode_len within H5Fint.c corrupts the instruction pointer during file header parsing in HDF5 libraries up to 1.14.3.

Why it matters to the business

Systems processing untrusted HDF5 files face risk of crashes or potential code execution from local attackers, disrupting scientific data workflows and requiring urgent library updates across dependent applications.

How an attack unfolds

An attacker with local access supplies a specially crafted HDF5 file that triggers the over-read in H5F_addr_decode_len when the library parses the file header, leading to instruction pointer corruption and possible control-flow hijacking.

How to fix it

Upgrade hdfgroup/hdf5 to the commit 88429b015e29c59de604b0f552001fb7cb7ed5d0 or later release containing the fix for H5F_addr_decode_len.

How to confirm the fix worked

Verify the installed HDF5 version or commit hash against the fixed revision, recompile dependent applications, and test file parsing with known-good and boundary-case HDF5 inputs.

Typical attack path

1. Obtain local access to a target system running vulnerable HDF5
2. Craft a malicious HDF5 file exploiting the decode length function
3. Induce the target application to open the file
4. Trigger heap over-read resulting in instruction pointer corruption
5. Achieve crash or attempt arbitrary code execution

How to detect it

Review application logs for unexpected crashes during HDF5 file opens, inspect process memory dumps for corruption around H5F_addr_decode_len, and correlate file access timestamps with anomalous behavior.

What your security team should do

• Immediately update all HDF5 installations to the patched commit
• Scan build pipelines and containers for vulnerable HDF5 versions
• Restrict processing of untrusted HDF5 files until patches are applied
• Monitor EPSS and exploit maturity indicators for any change