Skip to main content

HDF5 CVE-2026-19029

| EUVDEUVD-2026-93981 MEDIUM
Out-of-bounds Read (CWE-125)
2026-10-06 HDFG GHSA-52jg-q5cg-3x56
Buffer Overflow Denial Of Service Information Disclosure Hdf5 The Hdf Group
6.8
CVSS 4.0 · Vendor: HDFG
Share

Severity by source

Vendor (HDFG) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Triggered by parsing a local crafted file so AV:L and UI:R; no privileges needed (PR:N); impact is a crash only, hence A:H with C:N/I:N and unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Patch available
Oct 06, 2026 - 22:20 EUVD
Analysis Generated
Oct 06, 2026 - 21:57 vuln.today
CVE Published
Oct 06, 2026 - 20:01 cve.org
MEDIUM 6.8

DescriptionCVE.org

A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.

AnalysisAI

Heap-based buffer over-read in the HDF5 library's scale-offset filter decoder (H5Z__filter_scaleoffset) allows a local, unauthenticated attacker to cause a denial of service by supplying a crafted HDF5 file that a victim opens. The flaw occurs when the filter's stored minimum-bits parameter equals the datatype's full precision and the decoder attempts to copy d_nelmts * size bytes from a compressed chunk that is too short, triggering an out-of-bounds read and application crash. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a victim to open or process an attacker-controlled HDF5 file whose dataset filter pipeline includes a scale-offset filter; the specific trigger is a stored minimum-bits value equal to the full precision of the datatype combined with a d_nelmts * size product that exceeds the actual compressed chunk length, causing the decoder to copy past the end of the chunk buffer. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, base 6.8 Medium) scopes this to an availability-only impact: a crash, with no confidentiality (VC:N) or integrity (VI:N) effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix from pull request #6718 (https://github.com/HDFGroup/hdf5/pull/6718), which adds bounds checks to H5Z__filter_scaleoffset() to prevent the over-read. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hdf5

View all
CVE-2018-13876 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13874 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13873 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13872 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13871 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13870 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13869 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13868 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13867 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13866 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2017-17509 HIGH POC
8.8 Dec 11

In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhd
CVE-2025-44904 HIGH POC
8.8 May 30

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Rated high severity (CVSS

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-19029 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy