CVE-2026-19026 The HDF Group CVE debrief

Who should care

Organizations and individuals using HDF5 version 2.3.0 or earlier, especially those working with large datasets or providing data processing services, should be aware of this vulnerability. This includes data scientists, researchers, and IT professionals handling HDF5 files.

Technical summary

The H5Z__filter_nbit function in H5Znbit.c of HDF5 through 2.3.0 is vulnerable to a denial of service attack. The function dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5. This allows attackers to create a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values. When such a file is opened and read using tools like h5ls or h5repack, it can cause a denial of service.

Defensive priority

Medium-priority defensive actions recommended due to potential denial of service via crafted HDF5 files.

Recommended defensive actions

• Inventory and assess systems for exposure to HDF5 files and affected tools.
• Implement compensating controls to monitor and restrict access to HDF5 files.
• Review and apply vendor remediation when available.
• Monitor for and track exceptions related to HDF5 file processing.
• Consider additional security measures for tools like h5ls and h5repack.

Evidence notes

Evidence from official CVE and NVD sources indicates a potential denial of service vulnerability in HDF5 through 2.3.0. The H5Z__filter_nbit function in H5Znbit.c dereferences cd_values without validating it or cd_nelmts, allowing for a crafted HDF5 file to cause issues when opened and read via tools like h5ls or h5repack.

Official resources