HDF5 <= 2.2.0 Multiple Vulnerabilities

The version of HDF5 installed on the remote host is 2.2.0 or earlier. It is, therefore, affected by multiple vulnerabilities: - H5Zfilternbit in H5Znbit.c dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the...

SUSE CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19027: Out-of-bounds Read

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19025

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

CVE-2026-19028

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial ...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19026 Nbit filter NULL/short parameter-array dereference

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

PT-2026-68347

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description The H5O layout decode function in H5Olayout.c fails to validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened. This validation...

PT-2026-68353

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description The functions H5Z nbit decompress one byte, H5Z nbit decompress one nooptype, and H5Z nbit decompress one atomic in H5Znbit.c advance a read index into the compressed chunk buffer without bounding it...

PT-2026-68348

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description The H5Z filter nbit function in H5Znbit.c dereferences cd values0 through cd values4 without verifying that cd values is non-NULL or that cd nelmts is at least 5, which is the required size for the filt...

CVE-2026-19025: Divide By Zero

H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...

CVE-2026-19026: NULL Pointer Dereference

H5Zfilternbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

PT-2026-68354

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1 Description A size t underflow occurs in the H5Z filter fletcher32 function within H5Zfletcher32.c. The issue arises when the software computes the data length to checksum by subtracting the 4-byte trailing checksu...