PatchTheCVECVE-2026-19026: H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without va
26
Routine
MEDIUM 6.8
CVE-2026-19026 is a medium-severity flaw (CVSS 6.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Publisher (CNA): HDFG
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.