CVE-2026-19029: HDF5 scale-offset filter heap buffer over-read via crafted chunk
A heap-based buffer over-read in H5Zfilterscaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies dnelmts size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using HDF5 through version 2.2.0 are affected when they open or process an attacker-crafted HDF5 file containing a dataset with scale-offset filter parameters under attacker control.
What must an attacker do to trigger the crash?
The attacker must induce the application to process a crafted HDF5 file. The malicious dataset uses scale-offset filter parameters such that the stored minimum bits equal the datatype's full precision, causing the decoder to copy more data than is present in the compressed chunk.
What is the practical impact?
The documented impact is denial of service: the heap-based buffer over-read can crash the application processing the crafted file. The provided data does not establish confidentiality or integrity impact.