CVE-2026-19026

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-19026
H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
CVSS

No CVSS.

References
Link Resource
https://github.com/HDFGroup/hdf5/issues/6489
https://github.com/HDFGroup/hdf5/issues/6492
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6489
Configurations

No configuration.

History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) H5Z__filter_nbit en H5Znbit.c en HDF5 versiones anteriores a la 2.3.0 desreferencia cd_values[0] a cd_values[4] sin validar que cd_values no sea NULL o que cd_nelmts sea al menos 5, el tamaño fijo de la cabecera del filtro. Esto permite a los atacantes causar una denegación de servicio a través de un archivo HDF5 manipulado que almacena el mensaje de la tubería del filtro N-Bit con cero valores de datos de cliente, abierto y leído a través de H5Dread, por ejemplo, por las herramientas h5ls o h5repack.

06 Oct 2026, 21:17

Type Values Removed Values Added
Summary (en) H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools. (en) H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
Information

Published : 2026-08-05 23:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-19026

Mitre link : CVE-2026-19026

CVE.ORG link : CVE-2026-19026

JSON object : View

Products Affected

No product.

CWE
CWE-476

NULL Pointer Dereference

CWE-1284

Improper Validation of Specified Quantity in Input