Skip to main content

HDF5 h5dump CVE-2026-19023

| EUVDEUVD-2026-53659 MEDIUM
Untrusted Pointer Dereference (CWE-822)
2026-08-05 HDFG GHSA-w2vw-9w6r-w7mm
Denial Of Service Hdf5 Suse
6.8
CVSS 4.0 · Vendor: HDFG
Share

Severity by source

Vendor (HDFG) PRIMARY
6.8 NONE
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Local delivery of crafted file with required user interaction to invoke h5dump; crash-only impact maps to A:H with no C or I effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
CVSS changed
Aug 06, 2026 - 16:22 NVD
6.8 (MEDIUM)
Analysis Generated
Aug 05, 2026 - 23:06 vuln.today

DescriptionCVE.org

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

AnalysisAI

Untrusted pointer dereference in HDF5's h5dump utility (before version 2.1.1) causes a denial of service when processing specially crafted HDF5 files containing variable-length string datasets with more than one element rendered in binary mode. The stride calculation for per-element offsets becomes corrupted, causing subsequent elements to be read from misaligned memory addresses and dereferenced as pointers, crashing the tool. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft HDF5 file with multi-element VL string dataset
Delivery
Deliver malicious file to target system
Exploit
User or pipeline invokes h5dump in binary mode
Execution
render_bin_output corrupts stride calculation
Persist
Misaligned address dereferenced as pointer
Impact
h5dump process crashes (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three specific conditions: (1) the target must run the h5dump utility - not just use the HDF5 library - so pipeline code that reads HDF5 via libhdf5 directly is not affected; (2) the HDF5 file being dumped must contain a variable-length string dataset (as opposed to fixed-length string or numeric datasets) with more than one element; and (3) h5dump must be invoked with binary output mode enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious HDF5 file containing a variable-length string dataset with two or more elements and provides it to a data analyst or automated pipeline that processes HDF5 files using h5dump in binary mode. When the analyst runs 'h5dump -b malicious.h5', the stride calculation is corrupted during rendering, subsequent elements are read from a misaligned memory region, the resulting garbage value is dereferenced as a pointer, and h5dump crashes. …
Remediation Upgrade HDF5 to version 2.1.1 or later, which contains the upstream fix for the render_bin_output stride calculation. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hdf5

View all
CVE-2018-13876 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13874 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13873 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13872 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13871 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13870 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13869 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13868 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13867 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13866 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2017-17509 HIGH POC
8.8 Dec 11

In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhd
CVE-2025-44904 HIGH POC
8.8 May 30

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Rated high severity (CVSS

Same weakness CWE-822 – Untrusted Pointer Dereference

View all
CVE-2024-21338 HIGH POC
7.8
CVE-2024-35250 HIGH POC
7.8
CVE-2023-21768 HIGH POC
7.8
CVE-2025-50165 CRITICAL
9.8
CVE-2026-33120 HIGH
8.8
CVE-2023-1437 CRITICAL
9.8
CVE-2018-17893 CRITICAL
9.8
CVE-2018-14811 CRITICAL
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for HPC 12 Affected

Share

CVE-2026-19023 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy