CVE-2026-19028 in HDF5
Summary
by MITRE • 08/06/2026
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability resides in the HDF5 library's implementation of the Fletcher32 checksum filter, specifically within the H5Z__filter_fletcher32 function located in H5Zfletcher32.c. This issue affects HDF5 versions through 2.3.0 and represents a classic buffer underflow condition that stems from inadequate input validation. The flaw manifests when the function attempts to compute the data length to be checksummed by performing a size_t subtraction operation that removes the 4-byte trailing checksum size from the total input buffer size, without first verifying that the buffer contains sufficient bytes to accommodate this operation.
The technical execution of this vulnerability occurs through a simple arithmetic underflow condition where the subtraction of 4 bytes from a buffer smaller than 4 bytes results in a massive positive integer value due to unsigned integer wraparound behavior. This creates an exploitable scenario where attackers can craft malicious HDF5 files containing Fletcher32-filtered data chunks that are smaller than the minimum required size of 4 bytes. When such malformed files are processed by HDF5 applications, particularly through operations like H5Dread which is invoked by command-line tools including h5ls and h5dump, the system attempts to read far beyond the allocated buffer boundaries.
The operational impact of this vulnerability extends to denial of service conditions that can completely crash applications and render them non-responsive. The massive out-of-bounds memory reads trigger application crashes during checksum computation in the H5_checksum_fletcher32 function, effectively preventing legitimate file processing operations from completing successfully. This vulnerability particularly affects tools that process HDF5 files containing filtered data, making it a significant concern for data analysis workflows where these utilities are commonly employed. The flaw demonstrates characteristics consistent with CWE-191 Integer Underflow (Wrap or Wraparound) and aligns with ATT&CK technique T1499.002 - Endpoint Denial of Service, as it enables adversaries to disrupt normal system operations through crafted input data.
Mitigation strategies should focus on implementing proper input validation that checks buffer sizes before performing arithmetic operations, particularly those involving unsigned integer calculations where underflow conditions can occur. The fix requires ensuring that input buffers are at least 4 bytes in size before attempting the subtraction operation that computes the checksum data length. Additionally, applications should validate the integrity of HDF5 file structures and implement proper bounds checking mechanisms to prevent out-of-bounds memory access. Organizations using HDF5 libraries should upgrade to patched versions that address this specific underflow condition, while also implementing defensive programming practices such as static analysis tools that can detect similar integer overflow and underflow vulnerabilities in their codebases.