CVE-2026-19028: HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

Vulnerability summary

CVE-2026-19028 is a medium (CVSS 6.8) Out-of-bounds Read vulnerability in the hdf group hdf5. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities.

Timeline

1. 05-08-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.