Bug 2547140 (CVE-2026-19029)

Summary: CVE-2026-19029 hdf5: HDF5: Denial of Service via crafted file in scale-offset filter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in HDF5. When decompressing data using the scale-offset filter, the library fails to verify whether a compressed data chunk is large enough before reading from it. An attacker could exploit this vulnerability by enticing a user or service to process a specially crafted HDF5 file, triggering an out-of-bounds memory read that results in an application crash and Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 20:22:23 UTC 
A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets a remote attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk is that large. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.