CVE-2024-32606
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint...
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
CVE-2024-32606- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
EUVDEUVD-2024-30408
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
EUVD-2024-30408- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m29j-f39x-2r24
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint...
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
GHSA-m29j-f39x-2r24- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
NVD
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
CVE-2024-32606- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
OSV
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
CVE-2024-32606- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-32606
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
DEBIAN-CVE-2024-32606- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVJLSEC-2026-301
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
JLSEC-2026-301- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2024-2407
hdf5 security update
HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
Security Fix(es):
HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166)
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606)
- Record
OESA-2024-2407- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2024-2408
hdf5 security update
HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
Security Fix(es):
HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166)
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606)
- Record
OESA-2024-2408- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2024-2409
hdf5 security update
HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
Security Fix(es):
HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166)
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606)
- Record
OESA-2024-2409- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVOESA-2024-2410
hdf5 security update
HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
Security Fix(es):
HDF5 through 1.14.3 contains a buffer overflow in H5O__linfo_decode, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution.(CVE-2024-29166)
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).(CVE-2024-32606)
- Record
OESA-2024-2410- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-32606
HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).
- Record
UBUNTU-CVE-2024-32606- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-32606 No score
CVE-2024-32606 in hdf5 - Patched by Root
Root has patched CVE-2024-32606 in the hdf5 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2024-32606- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hdf5Debian:12 |
All versions, plus listed versions 1.10.10+repack-11.10.10+repack-21.10.10+repack-31.10.10+repack-3.11.10.10+repack-3.2 Show 45 moreShow less1.10.10+repack-3.2+ports1.10.10+repack-3.31.10.10+repack-41.10.10+repack-51.10.8+repack1-11.12.0+repack-1~exp11.12.0+repack-1~exp21.12.2+repack-1~exp11.14.3+repack-1~exp11.14.3+repack1-1~exp21.14.3+repack1-1~exp31.14.4.3+repack-1~exp11.14.4.3+repack-1~exp21.14.4.3+repack-1~exp31.14.5+repack-11.14.5+repack-1~exp11.14.5+repack-1~exp21.14.5+repack-1~exp31.14.5+repack-1~exp41.14.5+repack-1~exp51.14.5+repack-1~exp61.14.5+repack-21.14.5+repack-31.14.5+repack-3.11.14.5+repack-3~exp11.14.5+repack-3~exp21.14.5+repack-3~exp31.14.5+repack-3~exp41.14.5+repack-41.14.5+repack-4~exp11.14.5+repack-4~exp21.14.5+repack-5~exp21.14.5+repack-5~exp31.14.6+repack-11.14.6+repack-1~exp11.14.6+repack-1~exp101.14.6+repack-1~exp111.14.6+repack-1~exp121.14.6+repack-1~exp131.14.6+repack-1~exp141.14.6+repack-1~exp151.14.6+repack-1~exp161.14.6+repack-1~exp171.14.6+repack-1~exp181.14.6+repack-1~exp19 |
None known |
hdf5Debian:13 |
before 1.14.5+repack-1 | 1.14.5+repack-1 |
hdf5Debian:14 |
before 1.14.5+repack-1 | 1.14.5+repack-1 |
HDF5_jllJulia |
before 2.0.0+0 | 2.0.0+0 |
hdf5openEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.14.5-1.oe2203sp3 | 1.14.5-1.oe2203sp3 |
hdf5openEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.14.5-1.oe2203sp1 | 1.14.5-1.oe2203sp1 |
hdf5openEuler:24.03-LTS From an advisory covering 2 CVEs |
before 1.14.5-1.oe2403 | 1.14.5-1.oe2403 |
hdf5openEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.14.5-1.oe2203sp4 | 1.14.5-1.oe2203sp4 |
hdf5Root:Debian:12 |
before 1.10.8+repack1-1.root.io.5 | 1.10.8+repack1-1.root.io.51.10.8+repack1-1.root.io.61.10.8+repack1-1.root.io.181.10.8+repack1-1.root.io.131.10.8+repack1-1.root.io.191.10.8+repack1-1.root.io.71.10.8+repack1-1.root.io.41.10.8+repack1-1.root.io.81.10.8+repack1-1.root.io.91.10.8+repack1-1.root.io.101.10.8+repack1-1.root.io.111.10.8+repack1-1.root.io.121.10.8+repack1-1.root.io.141.10.8+repack1-1.root.io.151.10.8+repack1-1.root.io.161.10.8+repack1-1.root.io.171.10.8+repack1-1.root.io.201.10.8+repack1-1.root.io.211.10.8+repack1-1.root.io.221.10.8+repack1-1.root.io.231.10.8+repack1-1.root.io.281.10.8+repack1-1.root.io.241.10.8+repack1-1.root.io.251.10.8+repack1-1.root.io.261.10.8+repack1-1.root.io.271.10.8+repack1-1.root.io.291.10.8+repack1-1.root.io.301.10.8+repack1-1.root.io.311.10.8+repack1-1.root.io.321.10.8+repack1-1.aikido.33 |
rootio-hdf5Root:Debian:12 |
before 1.10.8+repack1-1.root.io.5 | 1.10.8+repack1-1.root.io.51.10.8+repack1-1.root.io.61.10.8+repack1-1.root.io.181.10.8+repack1-1.root.io.131.10.8+repack1-1.root.io.191.10.8+repack1-1.root.io.71.10.8+repack1-1.root.io.41.10.8+repack1-1.root.io.81.10.8+repack1-1.root.io.91.10.8+repack1-1.root.io.101.10.8+repack1-1.root.io.111.10.8+repack1-1.root.io.121.10.8+repack1-1.root.io.141.10.8+repack1-1.root.io.151.10.8+repack1-1.root.io.161.10.8+repack1-1.root.io.171.10.8+repack1-1.root.io.201.10.8+repack1-1.root.io.211.10.8+repack1-1.root.io.221.10.8+repack1-1.root.io.231.10.8+repack1-1.root.io.281.10.8+repack1-1.root.io.241.10.8+repack1-1.root.io.251.10.8+repack1-1.root.io.261.10.8+repack1-1.root.io.271.10.8+repack1-1.root.io.291.10.8+repack1-1.root.io.301.10.8+repack1-1.root.io.311.10.8+repack1-1.root.io.321.10.8+repack1-1.aikido.33 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
hdf5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.8.11-3ubuntu11.8.11-5ubuntu11.8.11-5ubuntu21.8.11-5ubuntu61.8.11-5ubuntu71.8.11-5ubuntu7.11.8.11-5ubuntu7.1+esm11.8.11-5ubuntu7.1+esm2 |
None known |
hdf5Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.8.15-patch1+docs-41.8.15-patch1+docs-51.8.16+docs-11.8.16+docs-21.8.16+docs-3 Show 6 moreShow less1.8.16+docs-3ubuntu11.8.16+docs-41.8.16+docs-4ubuntu11.8.16+docs-4ubuntu1.11.8.16+docs-4ubuntu1.1+esm11.8.16+docs-4ubuntu1.1+esm2 |
None known |
hdf5Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.10.0-patch1+docs-41.10.0-patch1+docs-4ubuntu0.1~esm11.10.0-patch1+docs-4ubuntu0.1~esm2 |
None known |
hdf5Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.10.4+repack-101.10.4+repack-111.10.4+repack-11ubuntu11.10.4+repack-11ubuntu1+esm1 |
None known |
hdf5Ubuntu:22.04:LTS |
All versions, plus listed versions 1.10.6+repack-51.10.7+repack-4ubuntu11.10.7+repack-4ubuntu2 |
None known |
hdf5Ubuntu:24.04:LTS |
All versions, plus listed versions 1.10.8+repack1-1ubuntu11.10.10+repack-3ubuntu11.10.10+repack-3.1ubuntu31.10.10+repack-3.1ubuntu4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-32606 is a medium vulnerability (CVSS 5.7) in Hdfgroup Hdf5, published May 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in hdf5 1.14.5+repack-1.
References
hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4
nvd.nist.gov/vuln/detail/CVE-2024-32606
github.com/advisories/GHSA-m29j-f39x-2r24
security-tracker.debian.org/tracker/CVE-2024-32606
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2407
Show 6 moreShow less
ubuntu.com/security/CVE-2024-32606
cve.org/CVERecord?id=CVE-2024-32606
Left out here: 28 versions. The JSON record has them.