NULL pointer dereference in HDF5 library

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 0253b833-3e77-4dfe-9d57-17db1a2f0a74

Description

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-19024

Affected Vendors & Products

Vendor	Product	Version / Range
hdf_group	hdf5	to 2.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the H5Pget_fill_value function of HDF5 before version 2.1.1. It occurs when a dataset's version 1 or 2 fill value message has the 'defined' flag set with a negative size field. This negative size is not normalized to the library's 'undefined' sentinel, leading to a NULL datatype being passed to H5T_path_find, causing a denial of service.

Impact Analysis

This vulnerability can cause a denial of service by crashing applications using affected HDF5 versions. Attackers could exploit it to make systems unresponsive or terminate unexpectedly, potentially leading to data unavailability or service disruption.

Mitigation Strategies

Upgrade HDF5 to version 2.1.1 or later to address the NULL pointer dereference issue in H5Pget_fill_value.

Hi! I’m here to help you understand CVE-2026-19024. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70