Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by HDFG

CVE-2026-19026Nbit filter NULL/short parameter-array dereference

Medium 6.8

In plain English

A medium-severity null pointer dereference in HDF5 from The HDF Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12hdf5no fix listedDEBIAN-CVE-2026-19026
Debian:13hdf5no fix listedDEBIAN-CVE-2026-19026
Debian:14hdf5no fix listedDEBIAN-CVE-2026-19026
Ubuntu:22.04:LTShdf5no fix listedUBUNTU-CVE-2026-19026
Ubuntu:24.04:LTShdf5no fix listedUBUNTU-CVE-2026-19026
Ubuntu:26.04:LTShdf5no fix listedUBUNTU-CVE-2026-19026
Ubuntu:26.10hdf5no fix listedUBUNTU-CVE-2026-19026

Affected products (as reported)

VendorProductVersions
The HDF Group HDF5 <=2.3.0

Weakness: CWE-476, CWE-1284 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References