CVE-2026-19026

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1

Description The H5Z filter nbit() function in H5Znbit.c dereferences cd values[0] through cd values[4] without verifying that cd values is non-NULL or that cd nelmts is at least 5, which is the required size for the filter header. This can lead to a denial of service when a crafted HDF5 file containing an N-Bit filter pipeline message with zero client-data values is opened and read using the H5Dread() function, such as when using the h5ls or h5repack tools.

Recommendations Update to version 2.3.1 or later.