CVE-2026-19024

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.0

Description A NULL pointer dereference occurs in the H5Pget fill value() function. This happens when a dataset contains a version 1 or 2 fill value message where the "defined" flag is set and the size field is negative. Because this value is not normalized to the library's "undefined" sentinel, it reaches H5T path find() with a NULL datatype, allowing an attacker to cause a denial of service.

Recommendations Update HDF5 to version 2.3.0 or later.