PatchTheCVECVE-2026-19028: H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtr
26
Routine
MEDIUM 6.8
CVE-2026-19028 is a medium-severity flaw (CVSS 6.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk sm
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Publisher (CNA): HDFG
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.