Detections
Analytics

HDF5 <= 2.2.0 Multiple Vulnerabilities

medium Nessus Plugin ID 362604

Synopsis

An application installed on the remote host is affected by multiple vulnerabilities.

Description

The version of HDF5 installed on the remote host is 2.2.0 or earlier. It is, therefore, affected by multiple vulnerabilities:

 - H5Z__filter_nbit in H5Znbit.c dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.
 (CVE-2026-19026)

 - The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
 (CVE-2026-19027)

 - H5Z__filter_fletcher32 in H5Zfletcher32.c computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. (CVE-2026-19028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

There is no released version of HDF5 that addresses these issues. Apply the upstream patch from HDFGroup/hdf5 pull request 6497, or upgrade to a release that includes it when one is available.

See Also

https://github.com/HDFGroup/hdf5/issues/6488

https://github.com/HDFGroup/hdf5/issues/6489

https://github.com/HDFGroup/hdf5/issues/6490

https://github.com/HDFGroup/hdf5/issues/6492

https://github.com/HDFGroup/hdf5/pull/6497

Plugin Details

Severity: Medium

ID: 362604

File Name: hdf5_cve-2026-19026.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 10/2/2026

Updated: 10/2/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.61

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:A/AC:M/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2026-19027

CVSS v3

Risk Factor: High

Base Score: 7.3

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: x-cpe:/a:hdfgroup:hdf5

Required KB Items: Host/local_checks_enabled, installed_sw/HDF5

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-19026, CVE-2026-19027, CVE-2026-19028

IAVB: 2026-B-0279