Denial of Service Risk in HDF5 by HDF Group

CVE-2026-19026

What is CVE-2026-19026?

A vulnerability in the HDF5 product allows attackers to exploit the H5Z__filter_nbit function in H5Znbit.c. By triggering the function with specially crafted HDF5 files containing an insufficient number of client data values, it's possible to induce a denial of service. This occurs due to the absence of checks for NULL values and the count of elements, potentially leading to service disruption when these files are accessed or manipulated through tools such as h5ls or h5repack.

References