🟠 High | Source: Microsoft Security Response Center
CVE-2026-26197 is a vulnerability in the HDF5 library’s H5Odtype.c file, where the array’s full size, element count, and element size are not validated to ensure they are consistent with one another. This mismatch can lead to memory corruption or out-of-bounds access, potentially allowing an attacker to crash an application or execute arbitrary code. It affects services or workloads running on Azure that process HDF5 data files.
Security Architect’s Take: Identify any Azure workloads — particularly data analytics, machine learning, or scientific computing pipelines — that ingest or process HDF5 files, and ensure the underlying HDF5 library is patched to a version that resolves this validation flaw. Apply the relevant Microsoft security update and restrict ingestion of untrusted HDF5 files until patching is confirmed.
Original advisory: CVE-2026-26197 Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c