CVE-2026-19027 The HDF Group CVE debrief

Who should care

Organizations and developers using HDF5 in their applications, especially those handling HDF5 files from untrusted sources, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 are vulnerable to an out-of-bounds heap read. This occurs when the functions advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. An attacker can exploit this vulnerability by providing a crafted HDF5 file with N-Bit filter parameters that describe more decompressed data than the stored compressed chunk actually contains. This can be triggered via H5Dread, e.g., by the h5ls or h5repack tools, potentially leading to disclosure of adjacent heap memory into decompressed dataset values.

Defensive priority

Organizations using HDF5 should prioritize patching this vulnerability to prevent potential out-of-bounds heap reads and adjacent heap memory disclosure.

Recommended defensive actions

• Apply patches or updates provided by the HDF5 maintainers to address the vulnerability
• Restrict access to HDF5 files from untrusted sources
• Monitor HDF5 usage and logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description indicates that the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.

Official resources