Heap-based Buffer Over-read in HDF5 Software by HDF Group

CVE-2026-19029

What is CVE-2026-19029?

A heap-based buffer over-read vulnerability in the HDF5 software allows attackers to exploit crafted HDF5 files. This issue arises in the H5Z__filter_scaleoffset() function, where the decoder improperly handles the 'minimum bits' variable leading to the risk of denial of service via application crashes. The flaw occurs when the system does not verify that the chunk contains the expected number of bytes during the decoding of data, potentially controlled through malicious scale-offset filter parameters.

References