HDF5 CVE-2026-19026

Q: What is the CVSS score of CVE-2026-19026?

CVE-2026-19026 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-53685 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-08-05 HDFG

GHSA-fr64-5gr2-c3jj

Denial Of Service Null Pointer Dereference Hdf5 The Hdf Group

6.8

CVSS 4.0 · Vendor: HDFG

Severity by source

Vendor (HDFG) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local file delivery required (AV:L), user must open the file (UI:R), no privileges needed, availability-only impact with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 23:31 vuln.today

Analysis Generated

Aug 05, 2026 - 23:31 vuln.today

DescriptionCVE.org

H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

AnalysisAI

Null pointer dereference in HDF5 through 2.3.0 allows denial of service when a user opens a crafted file containing a malformed N-Bit filter pipeline message with zero client-data values. The function H5Z__filter_nbit unconditionally reads cd_values[0] through cd_values[4] before checking whether the array is non-NULL or contains at least 5 elements, crashing any application - including the bundled h5ls and h5repack tools - that calls H5Dread on such a dataset. No active exploitation has been confirmed (not listed in CISA KEV) and no EPSS score was available, but the fix diff publicly exposes the exact crash path, lowering the barrier for proof-of-concept development.

Technical ContextAI

HDF5 (Hierarchical Data Format version 5) is a scientific data format and C library maintained by The HDF Group, broadly deployed in HPC, machine learning dataset pipelines, and scientific computing frameworks. The N-Bit filter (pipeline ID 305), implemented in H5Znbit.c, is a compression element that strips redundant bits from fixed-precision integer and floating-point data. Its decode entry point H5Z__filter_nbit expects the cd_values array to hold at least 5 fixed header elements (number of parameters, no-compression flag, element count, datatype class, and datatype size) before any datatype-derived offsets are applied. CWE-476 (NULL Pointer Dereference) is the root cause: the function dereferences cd_values[0..4] unconditionally, without gating on cd_values != NULL or cd_nelmts >= 5. The fix in PR #6497 inserts an explicit rejection guard ('if (cd_values == NULL || cd_nelmts < 5) HGOTO_ERROR(...)') and introduces the H5Z_NBIT_PARMS_AVAIL macro to bound all subsequent parameter-array walks against the supplied element count. A companion fix in H5Zfletcher32.c addresses a related size_t underflow in the Fletcher32 filter, indicating a broader audit of filter input validation was performed.

RemediationAI

An upstream fix is available as GitHub Pull Request #6497 (https://github.com/HDFGroup/hdf5/pull/6497); however, a released and tagged patched version beyond 2.3.0 is not independently confirmed from the available references. Users should monitor The HDF Group's GitHub releases page for a version that incorporates the CHANGELOG entry 'Fixed crashes when reading datasets with malformed N-Bit or Fletcher32 filter metadata' and apply that release when available. As a compensating control until a patched release ships, avoid processing HDF5 files from untrusted sources using h5ls, h5repack, or any application path that invokes H5Dread on N-Bit-filtered datasets. Running such processing in a sandboxed or containerized process (e.g., a restricted Linux namespace or seccomp-filtered container) limits the blast radius of a crash to the isolated process without exposing the host. Input-level rejection of HDF5 files whose filter pipeline metadata declares fewer than 5 client-data parameters is not feasible without library-level instrumentation, making the upstream patch the only authoritative fix.