CVE-2026-19026 in HDF5
Summary
by MITRE • 08/06/2026
H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in question resides within the HDF5 library's N-Bit filter implementation, specifically in the H5Z__filter_nbit function located in H5Znbit.c. This flaw represents a classic null pointer dereference issue that occurs when the software fails to properly validate input parameters before attempting to access them. The vulnerability affects HDF5 versions through 2.3.0 and stems from inadequate bounds checking of the client data array cd_values, which is expected to contain exactly five elements according to the filter's fixed header structure. When an attacker crafts a malicious HDF5 file containing an N-Bit filter pipeline message with zero client-data values, the system attempts to dereference cd_values[0] through cd_values[4] without first verifying that cd_values points to valid memory or that cd_nelmts contains at least five elements.
The technical exploitation of this vulnerability occurs during normal HDF5 file operations when the library processes data structures containing the malicious N-Bit filter configuration. The H5Dread function, which is commonly used by tools such as h5ls and h5repack for reading HDF5 datasets, triggers the vulnerable code path when encountering these specially crafted files. This creates a denial of service condition where the application crashes or becomes unresponsive due to the null pointer dereference, effectively preventing legitimate users from accessing valid HDF5 data. The flaw demonstrates poor input validation practices that align with CWE-476, which specifically addresses null pointer dereference vulnerabilities in software systems.
The operational impact of this vulnerability extends beyond simple service disruption as it can affect any application or tool that relies on HDF5 for data management and processing. Security researchers have identified this issue as particularly concerning because it can be triggered through common file operations without requiring special privileges or complex attack vectors. The vulnerability affects the broader data integrity and availability aspects of systems using HDF5, especially in scientific computing environments where large datasets are frequently processed. From an ATT&CK framework perspective, this vulnerability maps to the T1499.004 technique related to network denial of service attacks, though it operates at the application level rather than network infrastructure.
Mitigation strategies for this vulnerability should focus on input validation and proper error handling within the HDF5 library codebase. The most effective immediate fix involves implementing bounds checking before any array element access, ensuring that cd_values is not null and that cd_nelmts meets minimum requirements before proceeding with filter processing operations. System administrators and security teams should update to patched versions of HDF5 as soon as possible, while also implementing monitoring for suspicious file access patterns that might indicate exploitation attempts. Additionally, organizations should consider implementing sandboxing techniques around HDF5 processing operations to limit the potential impact of such vulnerabilities in production environments. The vulnerability highlights the importance of robust input validation in scientific computing libraries where data integrity is paramount and security considerations must be integrated into the core software development lifecycle.