---
license: mit
tags: [security, poc, hdf5]
---
# Harmless PoC: HDF5 `H5R__decode_string` ATTR-ref strlen OOB read

After `H5T__ref_disk_read` / `blob_get` size checks pass, `H5R__decode_string` trusts a blob `uint16` name length with no remaining-buffer check → ASan heap-buffer-overflow **READ** on `H5Dread` of crafted `H5T_STD_REF` ATTR refs.

Distinct from CVE-2026-29043 (`H5T__ref_mem_setnull`).

## Files
- `mismatch_attr_strlen.h5`, `poc_read_ref.c`, `asan.log`, `NOTES.md`