CVE-2026-19028 The HDF Group CVE debrief

Who should care

Users of HDF5, especially those processing untrusted HDF5 files, should be aware of this vulnerability. This includes data scientists, researchers, and developers working with HDF5 files from untrusted sources. They should review their current installations, verify the integrity of processed files, and implement compensating controls to limit exposure.

Technical summary

The H5Z__filter_fletcher32 function in HDF5 through 2.3.0 is vulnerable to a size_t underflow. This occurs when computing the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes. An attacker can exploit this by providing a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, which can be triggered via functions like H5Dread, potentially causing a denial of service through massively out-of-bounds reads and application crashes.

Defensive priority

Medium priority given the CVSS score of 6.8 and potential for denial of service attacks.

Recommended defensive actions

• Inventory checks for HDF5 installations and versions affected by CVE-2026-19028
• Apply vendor remediation when available
• Monitor for suspicious HDF5 file reads and processing
• Implement compensating controls to limit exposure
• Review and update asset inventory to include systems that process HDF5 files
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-19028 record indicates a size_t underflow in HDF5's H5Z__filter_fletcher32 function, allowing for a denial of service via a crafted HDF5 file. Evidence is based on NVD and CVE.org records. The vulnerability arises from the function's computation of the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes. This issue can be triggered via functions like H5Dread, potentially causing massively out-of-bounds reads and application crashes. Users should verify their HDF5 installations and processing of untrusted HDF5 files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.