CVE-2026-19028HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read
Updated under an hour ago ()
Does this affect you?
It affects The HDF Group HDF5. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
- CVSS
- 6.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-190, CWE-125, CWE-1284
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- HDFG
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
The HDF Group HDF5 hdf_group:hdf5 (from the name) | through 2.3.0 | CNA record |
References
- https://github.com/HDFGroup/hdf5/pull/6497
- https://github.com/HDFGroup/hdf5/issues/6488
- https://github.com/HDFGroup/hdf5/issues/6490
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.