CVE-2026-19025 The HDF Group CVE debrief

Who should care

Organizations using HDF5 library in their applications, especially those processing untrusted HDF5 files, should review and apply patches or updates to mitigate potential denial-of-service attacks. This includes operators of affected systems, vulnerability management teams, and security teams responsible for monitoring and defending against potential threats. Additionally, developers and maintainers of software that utilizes HDF5 should assess their exposure and implement necessary mitigations.

Technical summary

The H5O__layout_decode function in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened. This allows attackers to cause a denial of service (divide-by-zero and application crash) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread. Affected product deployments should review and apply patches or updates to mitigate potential denial-of-service attacks.

Defensive priority

Medium-priority defensive review recommended due to potential for denial-of-service attacks via crafted HDF5 files.

Recommended defensive actions

• Review and apply vendor patches or updates for HDF5
• Implement compensating controls such as input validation and data sanitization
• Monitor systems for suspicious activity related to HDF5 file processing
• Consider using alternative file formats or libraries with built-in security features
• Perform a thorough review of affected product deployments in managed environments
• Track exceptions and retest remediated assets after applying patches or mitigations
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicates a potential denial-of-service vulnerability in HDF5 through 2.3.0. The H5O__layout_decode function in H5Olayout.c does not validate chunked dataset layout dimensionality when opening existing datasets, which can lead to a divide-by-zero error and application crash. Limited source detail suggests verifying dataset ranks and chunk layouts during processing, and reviewing system logs for potential crashes or errors related to HDF5 file handling.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.