CVE-2026-19028

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-19028
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
CVSS

No CVSS.

References
Link Resource
https://github.com/HDFGroup/hdf5/issues/6488
https://github.com/HDFGroup/hdf5/issues/6490
https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6488
Configurations

No configuration.

History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) H5Z__filter_fletcher32 en H5Zfletcher32.c en HDF5 versiones anteriores a 2.3.0 calcula la longitud de los datos para el checksum restando el tamaño del checksum final de 4 bytes del tamaño del búfer de entrada sin comprobar que el búfer tenga al menos 4 bytes, lo que permite un desbordamiento negativo (underflow) de tipo size_t. Esto permite a los atacantes causar una denegación de servicio (lectura masiva fuera de límites y caída de la aplicación en H5_checksum_fletcher32) mediante un archivo HDF5 manipulado con un fragmento (chunk) filtrado con Fletcher32 de menos de 4 bytes, activado a través de H5Dread, por ejemplo, mediante las herramientas h5ls o h5dump.

06 Oct 2026, 21:17

Type Values Removed Values Added
Summary (en) H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. (en) H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
Information

Published : 2026-08-06 00:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-19028

Mitre link : CVE-2026-19028

CVE.ORG link : CVE-2026-19028

JSON object : View

Products Affected

No product.

CWE
CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound

CWE-1284

Improper Validation of Specified Quantity in Input