CVE-2026-19025 in HDF5
Summary
by MITRE • 08/06/2026
H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability exists in the HDF5 library version 2.3.0 and earlier where the H5O_layout_decode function in H5Olayout.c fails to validate chunked dataset layout dimensionality against dataspace rank during dataset opening operations. This validation gap occurs specifically when opening existing datasets rather than during creation time when proper checks are performed. The flaw allows attackers to craft malicious HDF5 files containing mismatched chunk and dataspace ranks that can trigger critical system failures when processed by applications utilizing the h5repack tool or direct H5Dopen2 and H5Dread function calls. This represents a classic validation bypass vulnerability where insufficient input sanitization during read operations creates a path for malformed data to propagate through the system.
The technical execution of this vulnerability relies on the specific behavior of the H5S__hyper_iter_get_seq_list function in src/H5Shyper.c which encounters a divide-by-zero condition when processing chunked datasets with mismatched dimensionalities. When an attacker opens a crafted HDF5 file containing such inconsistent metadata, the library attempts to process hypercube iterators without proper dimensional validation, leading to arithmetic exceptions and subsequent application crashes. This type of vulnerability aligns with CWE-129 Input Validation and can be categorized under ATT&CK technique T1499.3 (Endpoint Denial of Service) as it specifically targets resource exhaustion through controlled input manipulation. The flaw demonstrates poor defensive programming practices where validation checks are inconsistently applied across different code paths within the same library.
The operational impact of this vulnerability extends beyond simple denial of service to potentially compromise entire data processing pipelines that depend on HDF5 libraries for scientific data management. Applications using h5repack or direct HDF5 API calls become vulnerable when processing untrusted HDF5 files, creating a significant risk in environments where file ingestion occurs without proper validation. The vulnerability is particularly dangerous in automated workflows, batch processing systems, and scientific computing environments where large volumes of data are processed through potentially untrusted sources. Attackers could exploit this to disrupt critical research data pipelines or cause cascading failures in data analysis platforms that rely on HDF5 format for storage and transfer.
Mitigation strategies should focus on immediate library updates to versions 2.3.1 or later where this validation gap has been addressed. Organizations should implement input validation measures before processing HDF5 files, particularly when dealing with external or untrusted sources, including preliminary metadata inspection and schema validation. The principle of least privilege should be applied to prevent unauthorized file creation or modification in systems processing sensitive scientific data. Additionally, defensive programming techniques such as bounds checking and comprehensive error handling should be enforced throughout the application stack that interfaces with HDF5 libraries, ensuring that any malformed input triggers appropriate error recovery rather than system crashes. Security monitoring should include detection of unusual patterns in HDF5 file processing that might indicate exploitation attempts.