CVE-2026-26199

MEDIUMPre-NVD 5.95.9Trending — 3 sources updated this weekElevated

5.9

EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS: 0%CVSS: 5.9Exploit: NoneExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Iget_name is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Iget_name is invoked in a way where size can be forced to zero, and there is important data before the name buffer.

CVSS v3: 5.9
EG Score: 5.9(low)
EPSS: 20.4%
KEV: Not listed

Published

July 20, 2026

Last Modified

July 20, 2026

Advisory Details (2)

Auto-updated Jul 20, 2026

🔬 Proof of concept available. Patch available. Sources: github.

github Patch Available🟡 PoC Available

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero · Advisory · HDFGroup/hdf5 · GitHub

https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc

generic

hdf5/src/H5Gname.c at develop · HDFGroup/hdf5 · GitHub

https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

CWE-124Buffer Underwrite

Data Freshness Timeline

(refreshed 8× in last 7d / 8× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

2026-07-22 14:08 UTCEPSS rescore
2026-07-22 14:08 UTCEPSS rescore
2026-07-21 15:24 UTCEPSS rescore
2026-07-21 15:24 UTCEPSS rescore
2026-07-20 19:39 UTCEG score recompute
2026-07-20 16:37 UTCEG score recompute
2026-07-20 15:23 UTCEG score recompute
2026-07-20 15:22 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-26199?

CVE-2026-26199 is a medium vulnerability published on July 20, 2026. HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way…

When was CVE-2026-26199 disclosed?

CVE-2026-26199 was first published in the National Vulnerability Database on July 20, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2026-26199 actively exploited?

CVE-2026-26199 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 20.4% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.

What is the CVSS score of CVE-2026-26199?

CVE-2026-26199 has a CVSS v3 base score of 5.9 (NVD). The EG score is currently aggregating — additional source signals are being incorporated as they become available..

How do I remediate CVE-2026-26199?

Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-26199, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-26199

Explore →

Is Your Infrastructure Affected by CVE-2026-26199?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs