CVE-2026-19023

Received Received - Intake

Untrusted Pointer Dereference in HDF5 h5dump Tool

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 0253b833-3e77-4dfe-9d57-17db1a2f0a74

Description

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-19023

Affected Vendors & Products

Vendor	Product	Version / Range
hdf_group	hdf5	2.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

Executive Summary

This vulnerability involves an untrusted pointer dereference in the HDF5 h5dump tool's render_bin_output function. It occurs when processing a variable-length string dataset with multiple elements in binary mode. The issue corrupts the per-element stride calculation, causing subsequent elements to be read from a misaligned offset and dereferenced as a pointer, leading to a denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of HDF5 installed on your system. If you are using a version prior to 2.1.1, your system may be vulnerable. Run the command 'h5dump --version' to check the installed version.

Impact Analysis

This vulnerability can cause a denial of service by crashing the h5dump tool when processing specific HDF5 files. If exploited, it may lead to application instability or termination, potentially disrupting data processing workflows that rely on HDF5 tools.

Mitigation Strategies

Immediately update HDF5 to version 2.1.1 or later to address the vulnerability. If updating is not immediately possible, avoid using h5dump in binary mode with variable-length string datasets containing more than one element.

Hi! I’m here to help you understand CVE-2026-19023. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70