CVE-2026-19023: HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
Published Aug 5, 2026
·Updated
Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
Affected Software
1 affected component
HDF Group HDF5 (h5dump)<2.3.0
Event History
Aug 5, 2026
CVE Published
via MITRE·10:13 PM
Data Sourced
via MITRE·10:13 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Mar 28, 58567
Event
via NVD·11:14 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-19023?
CVE-2026-19023 has a risk severity rating of 23.
2
How do I fix CVE-2026-19023?
To fix CVE-2026-19023, update HDF5 to version 2.1.1 or later.
3
What is the impact of CVE-2026-19023?
The impact of CVE-2026-19023 is a denial of service caused by untrusted pointer dereference in the h5dump tool.
4
Which versions of HDF5 are affected by CVE-2026-19023?
HDF5 versions prior to 2.1.1 are affected by CVE-2026-19023.
5
What component of HDF5 does CVE-2026-19023 affect?
CVE-2026-19023 affects the render_bin_output function within the h5dump tool of HDF5.