CVE-2026-19026: Nbit filter NULL/short parameter-array dereference
H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues[0] through cdvalues[4] without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19026?
CVE-2026-19026 is classified as risk level 26.
How do I fix CVE-2026-19026?
To fix CVE-2026-19026, update to the latest version of HDF5 that addresses the null pointer dereference issue.
What causes CVE-2026-19026?
CVE-2026-19026 is caused by the H5Z__filter_nbit function dereferencing a potentially NULL cd_values array without sufficient validation.
What impact does CVE-2026-19026 have?
CVE-2026-19026 can lead to a denial of service when processing crafted HDF5 files.
In which versions of HDF5 does CVE-2026-19026 exist?
CVE-2026-19026 affects HDF5 versions prior to 2.3.0.