Medium [CVE-2026-19024] Denial of service via malformed dataset
This medium-severity Red Hat Linux advisory covers CVE-2026-19024 affecting Red Hat Enterprise Linux AI (RHEL AI) 3.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
A flaw was found in HDF5. A local attacker could exploit a vulnerability in the `H5Pget_fill_value` function by providing a specially crafted dataset.
This could lead to a denial of service, making the system unavailable. When this unnormalized structure is evaluated, it passes a NULL datatype pointer to H5T_path_find, resulting in a NULL pointer dereference.
Successful exploitation causes the calling application process to terminate abruptly, resulting in a localized denial of service (DoS).
Because the vulnerability results strictly in a NULL dereference crash without memory corruption, privilege escalation, or unauthorized data exposure, confidentiality and integrity are unaffected, and the blast radius is confined to the individual parsing process. Due to these reasons, this vulnerability has been rated with a Moderate severity.
Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476.
Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3.
- < 2.3.0
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation checklist
- To reduce risk prior to patching, restrict processing HDF5 files from untrusted sources, or run file-parsing workflows within isolated, unprivileged worker processes to prevent a potential crash from impacting core operations.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.