HDF5 h5dump EUVD-2026-53659

Q: What is the CVSS score of EUVD-2026-53659?

EUVD-2026-53659 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-19023 MEDIUM

Untrusted Pointer Dereference (CWE-822)

2026-08-05 HDFG

GHSA-w2vw-9w6r-w7mm

Denial Of Service Hdf5 The Hdf Group

6.8

CVSS 4.0 · Vendor: HDFG

Severity by source

Vendor (HDFG) PRIMARY

6.8 NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local delivery of crafted file with required user interaction to invoke h5dump; crash-only impact maps to A:H with no C or I effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.8 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 23:06 vuln.today

DescriptionCVE.org

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

AnalysisAI

Untrusted pointer dereference in HDF5's h5dump utility (before version 2.1.1) causes a denial of service when processing specially crafted HDF5 files containing variable-length string datasets with more than one element rendered in binary mode. The stride calculation for per-element offsets becomes corrupted, causing subsequent elements to be read from misaligned memory addresses and dereferenced as pointers, crashing the tool. No public exploit code exists at time of analysis, and no active exploitation has been confirmed - the local attack vector and DoS-only impact make this a low operational priority for most environments.

Technical ContextAI

HDF5 (Hierarchical Data Format version 5) is a data model, library, and file format developed by The HDF Group for storing and managing large, complex scientific data. The h5dump CLI utility, bundled with the library, renders HDF5 file contents in human-readable or binary form. The affected function render_bin_output in h5dump processes dataset elements iteratively using per-element stride values (byte offsets between sequential elements). For variable-length string datasets - those whose element sizes are not fixed at compile time - the stride calculation is apparently corrupted when more than one element is present and binary output mode is selected (typically via the -b flag). This forces pointer arithmetic to land at a misaligned memory address, after which the value at that address is dereferenced as a pointer, triggering an untrusted pointer dereference (CWE-822). Affected product is identified via CPE cpe:2.3:a:the_hdf_group:hdf5:*:*:*:*:*:*:*:* targeting all versions prior to 2.1.1.

RemediationAI

Upgrade HDF5 to version 2.1.1 or later, which contains the upstream fix for the render_bin_output stride calculation. The fix is tracked in the HDF Group GitHub issue at https://github.com/HDFGroup/hdf5/issues/6486. Until patching is possible, the most targeted workaround is to avoid invoking h5dump with binary output mode (the -b or --binary flag) on untrusted or externally sourced HDF5 files - this disables the specific code path that triggers the vulnerability, with the trade-off of losing binary dump functionality. A second compensating control is to process untrusted HDF5 files only within a sandboxed or resource-limited environment (e.g., a container with a memory limit or seccomp profile) so that a crash of h5dump does not cascade to broader pipeline failures. Neither workaround eliminates the underlying bug.