CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets
Attackers can cause denial of service in HDF5 h5dump by providing a crafted variable-length string dataset that triggers a pointer dereference error.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19023?
CVE-2026-19023 is a medium-severity vulnerability in The HDF Group HDF5, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.
Weakness: CWE-822
Which versions are affected by CVE-2026-19023?
How do I fix CVE-2026-19023?
Upgrade to a fixed version.
Is CVE-2026-19023 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19023 exists.
Sources
Also known as AZL-94493, DEBIAN-CVE-2026-19023, ECHO-664c-66c9-a47c, GHSA-w2vw-9w6r-w7mm, UBUNTU-CVE-2026-19023.