NULL Pointer Dereference in HDF5 Affects Data Management

CVE-2026-19024

What is CVE-2026-19024?

A NULL pointer dereference vulnerability exists in the HDF5 library prior to version 2.1.1, which can lead to denial of service. If an attacker crafts a dataset with a fill value message that has the 'defined' flag set and contains a negative size field, it bypasses the library's checks and triggers a NULL datatype during processing in the H5T_path_find function. This could allow the attacker to cause unexpected crashes or degrade the service performance.

References