CVE-2026-19024 in HDF5
Summary
by MITRE • 08/06/2026
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability represents a critical null pointer dereference flaw in the HDF5 library affecting versions prior to 21.1.0, specifically within the H5Pget_fill_value function. The issue stems from inadequate input validation and normalization of dataset metadata fields, creating a condition where maliciously crafted datasets can trigger arbitrary code execution or system instability. The vulnerability manifests when a dataset contains a fill value message with the "defined" flag set alongside a negative size field that bypasses proper normalization to the library's internal "undefined" sentinel value. This allows the problematic data structure to propagate through the H5T_path_find function where it encounters a NULL datatype pointer, leading to a segmentation fault or denial of service condition.
The technical exploitation of this vulnerability involves crafting HDF5 datasets with malformed fill value metadata that violates expected field constraints. When the library processes these datasets, the unnormalized negative size field fails to properly transition to the undefined sentinel state that the system expects for handling missing or invalid data types. This failure creates a path where the datatype parameter becomes NULL when passed to H5T_path_find, resulting in immediate null pointer dereference. The vulnerability demonstrates poor defensive programming practices and inadequate boundary checking within the HDF5 type system's metadata processing pipeline, particularly affecting version 1 and 2 fill value message formats that are commonly used in scientific data storage applications.
From an operational impact perspective, this vulnerability poses significant risks to systems heavily dependent on HDF5 for data storage and retrieval operations. Attackers can exploit this flaw to cause denial of service conditions across applications using HDF5 libraries, potentially disrupting critical scientific computing workflows, data analysis platforms, or storage systems that rely on proper handling of fill values in scientific datasets. The vulnerability affects the fundamental data integrity and availability aspects of systems processing large scientific datasets, as any attempt to access or query affected datasets will result in application crashes or system instability. This impacts both interactive applications and automated systems where dataset metadata validation is deferred until actual data access occurs.
The mitigation strategies for this vulnerability should focus on immediate library updates to version 2.1.1 or later where the normalization issue has been addressed through proper input validation and field boundary checking mechanisms. Organizations should implement strict input validation procedures for all HDF5 datasets, particularly those originating from untrusted sources, including pre-processing checks for negative size fields in fill value messages. System administrators should consider implementing monitoring solutions that can detect unusual patterns of dataset access or application crashes related to HDF5 processing, while also ensuring regular patch management protocols are followed across all systems utilizing HDF5 libraries. Additionally, organizations may need to implement sandboxing or restricted execution environments for applications handling potentially malicious HDF5 data, following the principle of least privilege as outlined in the mitre ATT&CK framework's defense in depth strategies.
This vulnerability aligns with CWE-476 which describes null pointer dereference conditions and demonstrates how improper input validation can lead to system instability. The flaw represents a classic example of insufficient error handling and boundary condition checking that allows malformed data to propagate through system components where it eventually causes critical failures. The attack surface extends across all applications that depend on HDF5 for scientific data management, including research institutions, financial analytics platforms, and government agencies processing large datasets. Organizations should also consider implementing automated dataset integrity checks and regular vulnerability assessments targeting their HDF5-dependent systems to identify similar normalization issues in other library functions or components.