Vulnerability Description
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
Related Weaknesses (CWE)
References
- https://github.com/HDFGroup/hdf5/issues/6488
- https://github.com/HDFGroup/hdf5/issues/6490
- https://github.com/HDFGroup/hdf5/pull/6497
- https://github.com/HDFGroup/hdf5/issues/6488
FAQ
What is CVE-2026-19028?
CVE-2026-19028 is a documented vulnerability. H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that t...
How severe is CVE-2026-19028?
CVSS scoring is not yet available for CVE-2026-19028. Check NVD for updates.
Is there a patch for CVE-2026-19028?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.