CVE-2022-26061

A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hdfgroup:hdf5:1.10.4:*:*:*:*:*:*:*

History

23 Aug 2022, 16:50

Type	Values Removed	Values Added
CWE	~~CWE-122~~	CWE-787
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
First Time		Hdfgroup hdf5 Hdfgroup
CPE		cpe:2.3:a:hdfgroup:hdf5:1.10.4:::::::*
References	~~(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487 -~~	(MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487 - Exploit, Technical Description, Third Party Advisory

22 Aug 2022, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-22 19:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-26061

Mitre link : CVE-2022-26061

CVE.ORG link : CVE-2022-26061

JSON object : View

Products Affected

hdfgroup

hdf5

CWE

CWE-787

Out-of-bounds Write

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2022-26061", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-08-22T19:15:09.487", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria en la funcionalidad gif2h5 de HDF5 Group libhdf5 versi\u00f3n 1.10.4. Un archivo GIF especialmente dise\u00f1ado puede conllevar a una ejecuci\u00f3n de c\u00f3digo. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad."}], "lastModified": "2022-08-23T16:50:56.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:1.10.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C82BB0E-2A5E-4273-8CF6-A3ED216F95F2"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}