Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-19025: HDF5 Crash: Malicious File Causes Data Crash
CVE-2026-19025 · published 3 months ago
Summary
A malicious HDF5 file can cause an HDF5 application to crash when opened. This is a risk because it can disrupt normal operations and data processing. Users should be cautious when opening HDF5 files from untrusted sources and consider verifying the integrity of files before using them with HDF5 applications.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | hdf5 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:22.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:24.04:LTS | canonical | hdf5 | All versions |
| Ubuntu:26.04:LTS | canonical | hdf5 | All versions |
| – | the hdf group | hdf5 | <= 2.3.0 |
| Debian:11 | debian | hdf5 | All versions |
| Debian:12 | debian | hdf5 | All versions |
| Debian:13 | debian | hdf5 | All versions |
Original advisory text
HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open
H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool.
References
- https://github.com/HDFGroup/hdf5/issues/6491
- https://security-tracker.debian.org/tracker/CVE-2026-19025 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-19025 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-19025 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-369Divide By Zero
Timeline
Published5 Aug 2026
Updated26 Oct 2026
First seen5 Aug 2026
Sources
CVE-2026-19025 · NVD
CVE-2026-19025 · MITRE
DEBIAN-CVE-2026-19025 · OSV
UBUNTU-CVE-2026-19025 · OSV
Track software like this
Free during beta