CVE-2026-19025

H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.

CVSS

No CVSS.

References

Link	Resource
https://github.com/HDFGroup/hdf5/issues/6491
https://github.com/HDFGroup/hdf5/issues/6491

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) H5O__layout_decode en H5Olayout.c en HDF5 hasta 2.3.0 no valida que la dimensionalidad del diseño de fragmentos almacenado de un conjunto de datos fragmentado coincida con su rango de espacio de datos cuando se abre un conjunto de datos existente, mientras que esta verificación se realiza solo en el momento de la creación del conjunto de datos. Esto permite a los atacantes causar una denegación de servicio (división por cero y caída de la aplicación en H5S__hyper_iter_get_seq_list en src/H5Shyper.c) a través de un archivo HDF5 manipulado con rangos de fragmento/espacio de datos no coincidentes que se abre y lee a través de H5Dopen2 y H5Dread, por ejemplo, por la herramienta h5repack.

Information

Published : 2026-08-05 23:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-19025

Mitre link : CVE-2026-19025

CVE.ORG link : CVE-2026-19025

JSON object : View

Products Affected

No product.

CWE

CWE-369

Divide By Zero

{"id": "CVE-2026-19025", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19025", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T14:34:22.854081Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "affectedData": [{"vendor": "The HDF Group", "product": "HDF5", "versions": [{"status": "affected", "version": "<= 2.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T23:16:53.483", "references": [{"url": "https://github.com/HDFGroup/hdf5/issues/6491", "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6491", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "description": [{"lang": "en", "value": "CWE-369"}]}], "descriptions": [{"lang": "en", "value": "H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool."}, {"lang": "es", "value": "H5O__layout_decode en H5Olayout.c en HDF5 hasta 2.3.0 no valida que la dimensionalidad del dise\u00f1o de fragmentos almacenado de un conjunto de datos fragmentado coincida con su rango de espacio de datos cuando se abre un conjunto de datos existente, mientras que esta verificaci\u00f3n se realiza solo en el momento de la creaci\u00f3n del conjunto de datos. Esto permite a los atacantes causar una denegaci\u00f3n de servicio (divisi\u00f3n por cero y ca\u00edda de la aplicaci\u00f3n en H5S__hyper_iter_get_seq_list en src/H5Shyper.c) a trav\u00e9s de un archivo HDF5 manipulado con rangos de fragmento/espacio de datos no coincidentes que se abre y lee a trav\u00e9s de H5Dopen2 y H5Dread, por ejemplo, por la herramienta h5repack."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}