Skip to main content

HDF5 CVE-2026-19028

| EUVDEUVD-2026-53676 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-08-05 HDFG GHSA-2hg9-348w-39gj
Integer Overflow Denial Of Service Buffer Overflow Hdf5 Suse Red Hat
6.8
CVSS 4.0 · Vendor: HDFG
Share

Severity by source

Vendor (HDFG) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

AV:L because a crafted file must be placed locally for processing; UI:R since a user or process must open the file; A:H for crash; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 05, 2026 - 23:51 vuln.today
Analysis Generated
Aug 05, 2026 - 23:51 vuln.today

DescriptionCVE.org

H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

AnalysisAI

Integer underflow in HDF5 through 2.3.0 allows denial of service when processing Fletcher32-filtered datasets with chunk sizes smaller than 4 bytes. The H5Z__filter_fletcher32 function in H5Zfletcher32.c subtracts the 4-byte checksum length from the input buffer size using an unsigned size_t without first verifying the buffer meets the minimum size, causing the result to wrap near SIZE_MAX and triggering a massively out-of-bounds read inside H5_checksum_fletcher32. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Craft HDF5 file with sub-4-byte Fletcher32 chunk
Delivery
Deliver file to victim filesystem or pipeline
Exploit
Victim opens file via h5ls/h5dump/application
Install
H5Dread triggers Fletcher32 filter decode
C2
size_t underflows to near SIZE_MAX
Execute
Massively out-of-bounds read in H5_checksum_fletcher32
Impact
Process crash (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) the target system runs HDF5 through version 2.3.0 with the Fletcher32 filter compiled in (default build); (2) the victim application or user calls `H5Dread` - directly or via tools such as `h5ls` or `h5dump` - on a dataset configured with the Fletcher32 filter; and (3) the attacker can supply or place a crafted HDF5 file containing a Fletcher32-filtered chunk smaller than 4 bytes in a location the victim processes. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N scores 6.8, accurately reflecting a local, user-interaction-dependent, availability-only impact with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts an HDF5 file containing a dataset with a Fletcher32-filtered chunk of 1-3 bytes - well below the minimum 4-byte checksum boundary - and delivers it to a target via a shared research dataset repository, email attachment, or malicious download. When a scientist or automated pipeline opens the file with `h5dump` or an HDF5-consuming application, `H5Dread` invokes the Fletcher32 decode path, the `size_t` underflow passes a near-`SIZE_MAX` length to the checksum routine, and the process crashes immediately with an out-of-bounds read. …
Remediation Monitor The HDF Group's releases for a tagged version incorporating the fix from PR #6497 (https://github.com/HDFGroup/hdf5/pull/6497) and upgrade HDF5 as soon as that version is published; the exact fix version is not yet confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hdf5

View all
CVE-2018-13876 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13874 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13873 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13872 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13871 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13870 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13869 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13868 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13867 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13866 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2017-17509 HIGH POC
8.8 Dec 11

In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhd
CVE-2025-44904 HIGH POC
8.8 May 30

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Rated high severity (CVSS

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for HPC 12 Affected

Share

CVE-2026-19028 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy