CVE-2026-19027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-19027
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
CVSS

No CVSS.

References
Link Resource
https://github.com/HDFGroup/hdf5/issues/6489
https://github.com/HDFGroup/hdf5/issues/6492
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6489
Configurations

No configuration.

History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Las funciones H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype y H5Z__nbit_decompress_one_atomic en H5Znbit.c de HDF5, en versiones anteriores a 2.3.0, avanzan un índice de lectura en el búfer de fragmentos comprimidos sin limitarlo al tamaño real del búfer. Esto permite a los atacantes provocar una lectura de pila fuera de límites (out-of-bounds heap read) y, en casos restringidos, la divulgación de memoria de pila adyacente en valores de conjuntos de datos descomprimidos, a través de un archivo HDF5 manipulado cuyos parámetros de filtro N-Bit describen más datos descomprimidos de los que el fragmento comprimido almacenado contiene realmente, lo que se activa a través de H5Dread, por ejemplo, mediante las herramientas h5ls o h5repack.

06 Oct 2026, 21:17

Type Values Removed Values Added
Summary (en) The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools. (en) The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
Information

Published : 2026-08-06 00:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-19027

Mitre link : CVE-2026-19027

CVE.ORG link : CVE-2026-19027

JSON object : View

Products Affected

No product.

CWE
CWE-125

Out-of-bounds Read