CVE-2026-19023: HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
Other sources
Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19023?
CVE-2026-19023 has a risk severity rating of 23.
How do I fix CVE-2026-19023?
To fix CVE-2026-19023, update HDF5 to version 2.1.1 or later.
What is the impact of CVE-2026-19023?
The impact of CVE-2026-19023 is a denial of service caused by untrusted pointer dereference in the h5dump tool.
Which versions of HDF5 are affected by CVE-2026-19023?
HDF5 versions prior to 2.1.1 are affected by CVE-2026-19023.
What component of HDF5 does CVE-2026-19023 affect?
CVE-2026-19023 affects the render_bin_output function within the h5dump tool of HDF5.