Medium [CVE-2026-19027] Information disclosure and denial of service via crafted HDF5 file
This medium-severity Red Hat Linux advisory covers CVE-2026-19027.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size.
This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
A flaw was found in HDF5, a widely used data management library. This vulnerability allows an attacker to craft a malicious HDF5 file that, when processed, can cause the application to read beyond its allocated memory.
This out-of-bounds read could lead to the disclosure of sensitive information or result in a denial of service (DoS), making the application unavailable. A boundary validation flaw exists in the N-Bit decompression routines (H5Z__nbit_decompress_one_*) within the HDF5 library.
When processing datasets via H5Dread(), the functions fail to bound the read index against the compressed buffer size.
- 2.3.0
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Do not open or process untrusted HDF5 files from unverified sources using tools or services linked against the HDF5 library. Enforce strict file-ingestion boundaries or access controls to prevent automated parsing of untrusted datasets.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.