CVE-2026-19027: HDF5 out-of-bounds heap read in N-Bit filter decompression
HDF5 out-of-bounds heap read in N-Bit filter decompression
Other sources
The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19027?
The severity of CVE-2026-19027 is rated at 43.
How do I fix CVE-2026-19027?
To fix CVE-2026-19027, update HDF5 to a version higher than 2.3.0 where the vulnerability is addressed.
What causes CVE-2026-19027?
CVE-2026-19027 is caused by an out-of-bounds heap read due to improper buffer size validation in HDF5 functions.
Which version of HDF5 is affected by CVE-2026-19027?
HDF5 versions up to and including 2.3.0 are affected by CVE-2026-19027.
What are the potential impacts of CVE-2026-19027?
The potential impacts of CVE-2026-19027 include the possibility of exploitation leading to information disclosure or application crashes.