Out-of-Bounds Read Vulnerability in HDF5 Products by HDF Group

CVE-2026-19027

What is CVE-2026-19027?

The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in HDF5 prior to version 2.3.0 contain a vulnerability that permits an attacker to advance a read index into the compressed chunk buffer without constraints, potentially leading to an out-of-bounds read situation. This can result in the disclosure of sensitive information stored in adjacent heap memory. Attackers can exploit this vulnerability using crafted HDF5 files with manipulated N-Bit filter parameters, which specify more decompressed data than the actual size of the stored compressed chunk, potentially triggered through functions like H5Dread, h5ls, or h5repack.

References