Vulnerability · Published Oct 6, 2026 · Assigned by HDFG
CVE-2026-19029HDF5 scale-offset filter heap buffer over-read via crafted chunk
Medium 6.8
In plain English
A medium-severity out-of-bounds read in HDF5 from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-19029 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-19029 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-19029 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:22.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:24.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:26.04:LTS | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-19029 |
| Ubuntu:26.10 | r-bioc-rhdf5lib | no fix listed | UBUNTU-CVE-2026-19029 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | HDF5 | < 2.2.0 |
Weakness: CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N