CVE-2026-19024

CVE-2026-19024 affects HDF5’s H5Pget_fill_value and causes a NULL pointer dereference in versions before 2.1.1. If a dataset uses a version 1 or 2 fill value message with the defined flag and a negative size, the value can reach H5T_path_find with a NULL datatype, leading to a denial of service. ...