CVE-2026-19026

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19026", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "state": "PUBLISHED", "assignerShortName": "HDFG", "dateReserved": "2026-08-05T22:14:40.349Z", "datePublished": "2026-08-05T22:47:58.227Z", "dateUpdated": "2026-10-06T20:32:13.006Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-10-06T20:32:13.006Z"}, "title": "Nbit filter NULL/short parameter-array dereference", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-476", "description": "CWE-476 NULL pointer dereference", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "affected": [{"vendor": "The HDF Group", "product": "HDF5", "versions": [{"status": "affected", "version": "<=2.3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.<br><br><br>"}]}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6497"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6489"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6492"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"references": [{"url": "https://github.com/HDFGroup/hdf5/issues/6489", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T14:31:41.789584Z", "id": "CVE-2026-19026", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:31:59.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19026", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T14:31:41.789584Z"}}}], "references": [{"url": "https://github.com/HDFGroup/hdf5/issues/6489", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:31:52.551Z"}}], "cna": {"title": "Nbit filter NULL/short parameter-array dereference", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The HDF Group", "product": "HDF5", "versions": [{"status": "affected", "version": "<=2.3.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6497"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6489"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6492"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.", "supportingMedia": [{"type": "text/html", "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.<br><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL pointer dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input"}]}], "providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-10-06T20:32:13.006Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19026", "state": "PUBLISHED", "dateUpdated": "2026-10-06T20:32:13.006Z", "dateReserved": "2026-08-05T22:14:40.349Z", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "datePublished": "2026-08-05T22:47:58.227Z", "assignerShortName": "HDFG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HDF5", "vendor": "The HDF Group", "versions": [{"status": "affected", "version": "<=2.3.0"}]}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools."}, {"lang": "es", "value": "H5Z__filter_nbit en H5Znbit.c en HDF5 versiones anteriores a la 2.3.0 desreferencia cd_values[0] a cd_values[4] sin validar que cd_values no sea NULL o que cd_nelmts sea al menos 5, el tama\u00f1o fijo de la cabecera del filtro. Esto permite a los atacantes causar una denegaci\u00f3n de servicio a trav\u00e9s de un archivo HDF5 manipulado que almacena el mensaje de la tuber\u00eda del filtro N-Bit con cero valores de datos de cliente, abierto y le\u00eddo a trav\u00e9s de H5Dread, por ejemplo, por las herramientas h5ls o h5repack."}], "id": "CVE-2026-19026", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19026", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T14:31:41.789584Z", "version": "2.0.3"}}]}, "published": "2026-08-05T23:16:53.617", "references": [{"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "url": "https://github.com/HDFGroup/hdf5/issues/6489"}, {"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "url": "https://github.com/HDFGroup/hdf5/issues/6492"}, {"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "url": "https://github.com/HDFGroup/hdf5/pull/6497"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/HDFGroup/hdf5/issues/6489"}], "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-1284"}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}]}

{"bugzilla": {"description": "hdf5: HDF5: Denial of service via crafted HDF5 file", "id": "2511851", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511851"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.", "A flaw was found in HDF5. A remote attacker could craft a malicious HDF5 file that, when opened and read, would cause an application using the HDF5 library to crash. This issue stems from improper validation of input data within the N-Bit filter, leading to a denial of service (DoS) and impacting the availability of services that process these files."], "mitigation": {"lang": "en:us", "value": "Do not open or process untrusted HDF5 files using applications or CLI tools (such as h5ls or h5repack) linked against vulnerable versions of the HDF5 library. Verify file sources or isolate untrusted file parsing within a restricted, sandboxed environment."}, "name": "CVE-2026-19026", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "hdf5", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hdf5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-05T22:47:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19026\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19026\nhttps://github.com/HDFGroup/hdf5/issues/6489\nhttps://github.com/HDFGroup/hdf5/issues/6492\nhttps://github.com/HDFGroup/hdf5/pull/6497"], "statement": "A flaw was found in HDF5's N-Bit filter implementation within H5Z__filter_nbit(). When processing dataset pipelines, the function accesses elements in the cd_values array without verifying that the pointer is non-NULL or that cd_nelmts meets the minimum 5-element header requirement. A local attacker can supply a crafted HDF5 file containing an N-Bit filter pipeline with zero client-data values. Opening and reading this file using H5Dread() or utilities like h5ls and h5repack triggers a NULL pointer dereference or out-of-bounds read, causing an application crash and denial of service.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.0]"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "HDF5", "source": "cna", "vendor": "The HDF Group"}, "product": "hdf5", "vendor": "hdfgroup"}], "created": "2026-08-06T00:30:03.927643+00:00", "updated": "2026-10-07T08:30:15.847504+00:00", "vendors": ["hdfgroup", "hdfgroup$PRODUCT$hdf5"]}