CVE-2026-19024 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
Attackers can cause denial of service in HDF5 by providing a malformed fill value message with a negative size field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19024?
CVE-2026-19024 is a high-severity vulnerability in The HDF Group HDF5, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
Weakness: CWE-476
Which versions are affected by CVE-2026-19024?
Linux distribution packages (10)
hdf5 Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-devel Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-mpich Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-mpich-devel Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-mpich-static Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-openmpi Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-openmpi-devel Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-openmpi-static Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
hdf5-static Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
java-hdf5 Red Hat:hummingbird:1 | All versions | 0:2.2.0-0.1.3.hum1 |
How do I fix CVE-2026-19024?
Upgrade to a fixed version.
Is CVE-2026-19024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19024 exists.
Sources
Also known as AZL-94505, DEBIAN-CVE-2026-19024, ECHO-15c1-bb78-dbe9, GHSA-c7cf-qx8c-5ph7, RHSA-2026:79131, UBUNTU-CVE-2026-19024.