CVE-2026-19023 in HDF5
Summary
by MITRE • 08/06/2026
Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability under discussion represents a critical untrusted pointer dereference flaw within the h5dump utility of the HDF5 library ecosystem, specifically affecting versions prior to 2.1.1. This issue manifests in the render_bin_output function where improper handling of variable-length string datasets during binary mode dumping creates a scenario ripe for denial of service exploitation. The root cause stems from inadequate validation of data structure alignment when processing multi-element variable-length strings, leading to corrupted stride calculations that fundamentally compromise memory access patterns.
The technical execution of this vulnerability occurs when the h5dump tool encounters a variable-length string dataset containing multiple elements and attempts to render it in binary format. During this process, the per-element stride calculation becomes corrupted due to improper offset management, causing subsequent data elements to be read from misaligned memory addresses. These misaligned offsets ultimately result in dereferencing operations targeting arbitrary memory locations that are interpreted as pointers, creating a pathway for system instability and potential exploitation. The flaw operates at the intersection of memory management and data structure parsing, where normal data processing routines become vectors for memory corruption.
From an operational perspective, this vulnerability presents significant risks to systems relying on HDF5 libraries for data processing and analysis, particularly in environments where automated tools or batch processing workflows utilize h5dump functionality. The denial of service impact can manifest as application crashes, system instability, or complete tool failure, disrupting legitimate data access patterns and potentially affecting downstream applications that depend on consistent data processing capabilities. The vulnerability is particularly concerning because it can be triggered through seemingly benign operations involving standard HDF5 dataset structures, making it difficult to predict and prevent in production environments.
The flaw aligns with CWE-476 which specifically addresses null pointer dereference conditions and relates to broader categories of memory safety issues within software libraries. From an attack framework perspective, this vulnerability maps to ATT&CK technique T1059.007 for execution via command-line interface and T1499.004 for denial of service attacks. The vulnerability demonstrates how seemingly routine data processing operations can become attack vectors when proper input validation and memory access controls are absent. Organizations should implement immediate mitigations including updating to HDF5 version 2.1.1 or later, implementing strict input validation for h5dump operations, and monitoring for anomalous behavior during binary dataset processing. Additionally, defensive measures such as sandboxing h5dump executions and implementing automated vulnerability scanning for affected libraries can provide layered protection against exploitation attempts targeting this memory corruption vulnerability.