CVE-2026-19027: 
HDF5 vulnerability analysis and mitigation

CVE-2026-19027 is an out-of-bounds heap read vulnerability in the HDF5 library's N-Bit filter decompression routines. Specifically, the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c advance a read index into the compressed chunk buffer without validating it against the buffer's actual size. The vulnerability affects HDF5 versions through 2.3.0 and was disclosed on August 6, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause (CWE-125: Out-of-bounds Read) lies in the N-Bit decompression call chain within H5Znbit.c: the nbytes (input buffer size) parameter was never threaded into the H5Z__nbit_decompress* helper functions, so the read index *j could be advanced arbitrarily far past the end of the compressed chunk buffer. A crafted HDF5 file can specify N-Bit filter parameters (e.g., d_nelmts=67108876) that describe far more decompressed data than the stored compressed chunk (e.g., 31 bytes) actually contains, causing H5Z__nbit_decompress_one_byte() to read out-of-bounds heap memory. Exploitation is triggered via H5Dread(), which is invoked by tools such as h5ls and h5repack when processing chunked datasets. The fix threads the input buffer size through the entire decompress call chain and adds bounds checks before every buffer[*j] access (HDF5 PR #6497, HDF5 Issue #6489).

Successful exploitation can cause a segmentation fault (SIGSEGV) in the processing application, resulting in a denial of service. In constrained cases, adjacent heap memory contents may be disclosed into decompressed dataset output values, creating a limited information disclosure risk. The vulnerability affects any application or tool that reads HDF5 files with N-Bit filtered chunked datasets via H5Dread(), including the h5ls and h5repack command-line tools (Github Advisory, HDF5 Issue #6492).

The NVD SSVC assessment classifies exploitation status as "poc," indicating proof-of-concept inputs exist; the original bug reports included PoC HDF5 files (Heap_Corruption_1.zip, OOB_Read.zip, etc.) that reliably trigger crashes (HDF5 Issue #6489, HDF5 Issue #6492). No evidence of in-the-wild exploitation or threat actor attribution has been observed. The EPSS score is approximately 0.127% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Craft a malicious HDF5 file: Create an HDF5 file containing a chunked dataset with the N-Bit filter applied. Set the N-Bit filter parameters (e.g., d_nelmts) to a very large value (e.g., 67108876) while storing only a small compressed chunk (e.g., 31 bytes), so the parameters describe far more decompressed data than the chunk contains.
2. Deliver the file to the target: Provide the crafted HDF5 file to a user or automated pipeline that processes HDF5 files — for example, by uploading it to a data ingestion service, sharing it via email, or placing it in a directory monitored by an HDF5-processing workflow.
3. Trigger H5Dread: The victim opens the file using h5ls -d <file>, h5repack <file> out.h5, or any application calling H5Dread() on the malicious dataset. This invokes H5Z_pipeline() → H5Z__filter_nbit() → H5Z__nbit_decompress() → H5Z__nbit_decompress_one_atomic() → H5Z__nbit_decompress_one_byte().
4. Out-of-bounds read occurs: Because *j (the read index into the compressed buffer) is not bounded against the buffer size, it advances past the end of the heap-allocated chunk buffer, reading adjacent heap memory.
5. Achieve objective: The process crashes with SIGSEGV (denial of service), or in constrained scenarios, adjacent heap memory is silently incorporated into the decompressed dataset output, potentially disclosing sensitive in-memory data (HDF5 Issue #6489, HDF5 PR #6497).

• Process: Unexpected SIGSEGV or segmentation fault crash of h5ls, h5repack, or any HDF5-linked application; crash dumps referencing H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_atomic, or H5Z__filter_nbit in the stack trace.
• Logs: Application error logs showing abnormal termination during H5Dread() operations on chunked datasets; core dump files generated by HDF5 tool processes.
• File System: Presence of unexpected or externally supplied HDF5 files with N-Bit filtered datasets in data ingestion directories; core dump files (e.g., core.*) in working directories of HDF5 tools.
• Network: Unusual inbound delivery of HDF5 files (.h5, .hdf5) from untrusted sources to systems running HDF5 processing pipelines (HDF5 Issue #6489, HDF5 Issue #6492).

Update HDF5 to a version newer than 2.3.0 that incorporates the fix from pull request #6497, which bounds-checks the read index *j against the input buffer size throughout the N-Bit decompression call chain (HDF5 PR #6497). As a workaround prior to patching, avoid processing HDF5 files from untrusted sources with tools such as h5ls and h5repack, and restrict access to HDF5 data ingestion pipelines to trusted inputs only. Organizations should monitor the HDF5 GitHub repository for an official patched release and apply it promptly (Github Advisory).