Untrusted Pointer Dereference in HDF5 Tool by HDF Group

CVE-2026-19023

What is CVE-2026-19023?

The HDF5 library, utilized in handling large datasets, contains a vulnerability in its h5dump tool that allows for an untrusted pointer dereference. This issue arises in the render_bin_output function and is triggered when a variable-length string dataset with multiple elements is dumped in binary mode. The flaw can lead to denial of service as it disrupts the per-element stride calculation, ultimately causing later elements to be read and dereferenced from incorrect memory offsets. Attackers exploiting this vulnerability can induce a crash or unexpected behavior in applications reliant on HDF5, necessitating immediate attention and remediation.

References