What is the CVSS score of CVE-2026-19024?

CVE-2026-19024 has a contested CVSS base score of 8.2 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of HDF5 are affected by CVE-2026-19024?

HDF5 (versions prior to 2.1.1) contains a flaw that can crash processes when handling specially crafted data files, potentially disrupting applications that analyze or process datasets.

How to fix or mitigate CVE-2026-19024?

Immediately within 24 hours, identify all HDF5 installations across your infrastructure and document which systems process external, user-supplied, or untrusted HDF5 data files; simultaneously alert applicable teams of the availability risk. Within 7 days, implement interim protections including validation of HDF5 file format before processing to detect malformed structures, sandbox HDF5 file parsing in restricted environments where operationally feasible, and enable logging to detect and alert on unexpected HDF5 processing failures. Within 30 days, establish monitoring for vendor patch release (target HDF5 2.1.1 or later), test patch deployment in staging, and develop a phased upgrade schedule prioritizing systems that ingest external data.

HDF5 CVE-2026-19024

EUVD-2026-53660 HIGH

NULL Pointer Dereference (CWE-476)

2026-08-05 HDFG

GHSA-c7cf-qx8c-5ph7

Denial Of Service Null Pointer Dereference Hdf5 The Hdf Group

High

Disputed · 8.2 Vendor: HDFG

Severity by source

Sources disagree (Low–High)

Vendor (HDFG) PRIMARY

8.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local file-parsing DoS requiring user interaction to open crafted file; no privileges needed, no C/I impact, availability crash is high severity.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 23:06 vuln.today

CVE Published

Aug 05, 2026 - 22:14 cve.org

HIGH 8.2

DescriptionCVE.org

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.

AnalysisAI

NULL pointer dereference in HDF5's H5Pget_fill_value function (all versions before 2.1.1) enables denial of service by processing a specially crafted HDF5 dataset file. The flaw arises when a fill value message (format version 1 or 2) carries the 'defined' flag alongside a negative size field - a malformed state the library fails to normalize to its internal 'undefined' sentinel - allowing a NULL datatype pointer to reach H5T_path_find and crash the process. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.2 reflects high availability impact, but the local file-parsing vector and user interaction requirement meaningfully constrain real-world exposure.

Technical ContextAI

HDF5 (Hierarchical Data Format 5) is a high-performance binary data management library maintained by The HDF Group (CPE: cpe:2.3:a:the_hdf_group:hdf5:*:*:*:*:*:*:*:*), extensively deployed in scientific computing, machine learning frameworks, and data-intensive pipelines. The affected function H5Pget_fill_value is part of the property list API responsible for retrieving fill values for datasets. When the library parses a fill value message in format version 1 or 2 from a file, it is expected to normalize the 'defined + negative size' combination to its internal 'undefined' sentinel before further processing. The bug (CWE-476: NULL Pointer Dereference) is that this normalization does not occur, permitting a NULL datatype pointer to propagate downstream to H5T_path_find, which then dereferences it and crashes. The flaw is rooted in insufficient input validation during file-format parsing - a common pattern in format-rich binary libraries.

RemediationAI

The primary fix is upgrading to HDF5 2.1.1 or later, which correctly normalizes malformed fill value messages before they reach H5T_path_find. The upstream fix is tracked at https://github.com/HDFGroup/hdf5/issues/6487. Where immediate upgrade is not feasible, restrict HDF5 file ingestion strictly to trusted, verified sources and implement file provenance controls to prevent untrusted datasets from reaching parsing code. Sandboxing HDF5-processing workflows - for example, running parsers in an isolated subprocess with strict resource and signal limits - can contain the blast radius of a crash to prevent cascading availability failures in dependent systems, though this adds operational complexity and does not eliminate the underlying flaw. Systems that exclusively process internally generated HDF5 files face negligible residual risk without workarounds.