Denial of Service Vulnerability in HDF5 Product by HDF Group

CVE-2026-19025

What is CVE-2026-19025?

The HDF5 library, versions prior to 2.3.0, contains a vulnerability where the H5O__layout_decode function fails to validate whether the stored chunk-layout dimensionality of a chunked dataset aligns with its dataspace rank. This oversight occurs only when a dataset is opened, whereas validation checks are typically performed at the time of dataset creation. Consequently, this flaw can be exploited by attackers through specially crafted HDF5 files that mismatch chunk and dataspace ranks, potentially leading to application crashes or denial of service when these files are processed using H5Dopen2 or H5Dread functions.

References