PatchTheCVECVE-2026-19027: The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic func
26
Routine
MEDIUM 6.9
CVE-2026-19027 is a medium-severity flaw (CVSS 6.9) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit f
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.9 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Passive |
| EPSS exploit chance | 0.2% (top 91%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): HDFG
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.