CVE-2026-19024CWE-476

CVE-2026-19024

published August 6, 2026

CVSS
8.2
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-08-06T03:16Z
References (2)
https://github.com/HDFGroup/hdf5/issues/6487 · 0253b833-3e77-4dfe-9d57-17db1a2f0a74https://github.com/HDFGroup/hdf5/issues/6487 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 AUG 22:14Z
    HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
    cvelistv5