CVE-2026-19028: falha de média gravidade em The HDF Group HDF5
HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
The HDF Group · HDF5CVEs relacionadas — The HDF Group HDF5
No mesmo produto, das mais perigosas para as menos.
CVE-2026-92627MEDIUMHeap Use-After-Free in H5T__conv_f_fEPSS 0.2%CVE-2026-19027MEDIUMHDF5 out-of-bounds heap read in N-Bit filter decompressionEPSS 0.2%CVE-2026-19026MEDIUMNbit filter NULL/short parameter-array dereferenceEPSS 0.2%CVE-2026-19024HIGHHDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value MessageEPSS 0.2%CVE-2026-120756LOWHeap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserializeEPSS 0.2%CVE-2026-120689MEDIUMUncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted FileEPSS 0.2%