CVE-2026-19023: HDF5 h5dump Tool DoS Vulnerability

CVE-2026-19023 Overview

CVE-2026-19023 is an untrusted pointer dereference vulnerability [CWE-822] in the render_bin_output function of the h5dump tool shipped with HDF5 versions before 2.1.1. The flaw triggers when h5dump processes a variable-length string dataset containing more than one element in binary mode. The per-element stride calculation is corrupted, causing subsequent elements to be read from a misaligned offset and dereferenced as a pointer. Attackers can weaponize crafted HDF5 files to cause a denial of service against users or automated pipelines that dump HDF5 datasets.

Critical Impact
A malformed HDF5 file processed by h5dump -b crashes the tool through dereferencing an attacker-influenced pointer, disrupting data-analysis workflows that rely on the utility.

Affected Products

HDF5 versions prior to 2.1.1
The h5dump command-line utility distributed with HDF5
Downstream distributions and scientific-computing pipelines bundling vulnerable HDF5 builds

Discovery Timeline

2026-08-05 - CVE-2026-19023 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-19023

Vulnerability Analysis

The h5dump tool is a diagnostic utility that serializes HDF5 datasets to text or binary output. When invoked in binary mode against a variable-length string dataset, the render_bin_output function iterates over dataset elements using a stride value computed from element metadata. For variable-length string datasets containing more than one element, this stride calculation is incorrect, so the function advances by the wrong byte offset between elements. Subsequent element reads land inside unrelated memory, and the bytes at that location are interpreted as a char* pointer. Dereferencing that value reads from an attacker-influenced address, producing a segmentation fault and terminating the process.

Root Cause

The root cause is a stride miscalculation in render_bin_output when handling variable-length string datasets. Because variable-length elements are represented internally as pointer-and-length descriptors rather than inline data, correct per-element striding is required to locate each descriptor. The incorrect stride causes misaligned reads that are then treated as valid pointers.

Attack Vector

Exploitation requires an attacker to deliver a crafted HDF5 file to a victim and induce them to run h5dump in binary mode against it. The CVSS 4.0 vector indicates a local attack path with user interaction. The impact is limited to denial of service; no confidentiality or integrity impact is defined in the metric set. Additional technical discussion is available in the HDF5 GitHub Issue #6486.

No public exploit code has been released. The vulnerability manifests deterministically once a multi-element variable-length string dataset is dumped with the -b flag.

Detection Methods for CVE-2026-19023

Indicators of Compromise

Repeated h5dump process crashes or segmentation faults in analyst workstations or batch data-processing hosts
Core dumps referencing the render_bin_output function or the HDF5 shared library
Unexpected HDF5 files arriving through email, shared storage, or dataset repositories immediately prior to tool crashes

Detection Strategies

Inventory hosts running HDF5 and identify installed versions below 2.1.1 through package-manager queries or h5dump --version
Monitor for abnormal termination of h5dump processes and correlate with the input file path passed on the command line
Hash-check inbound HDF5 files against known-good datasets before batch processing

Monitoring Recommendations

Alert on h5dump invocations that use the -b or --binary flag against files sourced from untrusted locations
Capture and retain crash artifacts from scientific-computing hosts to support triage of malformed-file incidents
Track HDF5 package versions across Linux distributions and container images used in analytics pipelines

How to Mitigate CVE-2026-19023

Immediate Actions Required

Upgrade HDF5 to version 2.1.1 or later on all systems that expose h5dump to user-supplied data
Restrict execution of h5dump in binary mode to trusted, validated input files only
Isolate batch HDF5 processing in sandboxed environments so a crash does not disrupt broader pipelines

Patch Information

HDF5 2.1.1 addresses the stride miscalculation in render_bin_output. Rebuild any statically linked tools and container images that embed vulnerable HDF5 libraries. Refer to the HDF5 GitHub Issue #6486 for the maintainer discussion and remediation status.

Workarounds

Avoid using h5dump -b against variable-length string datasets until the upgrade is applied
Convert untrusted HDF5 files to a normalized representation with a validated tool before dumping
Run h5dump under a supervisor that automatically restarts terminated jobs to reduce operational impact

bash

# Verify the installed HDF5 version and remove vulnerable builds
h5dump --version
# Example on Debian-based systems
sudo apt-get update && sudo apt-get install --only-upgrade hdf5-tools
# Confirm the patched version is 2.1.1 or newer
h5dump --version