CVE-2026-19027

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.1

Description The functions H5Z nbit decompress one byte(), H5Z nbit decompress one nooptype(), and H5Z nbit decompress one atomic() in H5Znbit.c advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This can lead to an out-of-bounds heap read—where the program reads data past the end of the allocated memory buffer—and potentially disclose adjacent heap memory into decompressed dataset values. This is triggered via H5Dread when processing a crafted HDF5 file where N-Bit filter parameters describe more decompressed data than the stored compressed chunk contains, which can be executed by tools such as h5ls or h5repack.

Recommendations Update to version 2.3.1 or later.