CVE-2026-19027

Name	CVE-2026-19027
Description	The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
hdf5 (PTS)	bullseye	1.10.6+repack-4+deb11u1	vulnerable
	bookworm	1.10.8+repack1-1	vulnerable
	trixie	1.14.5+repack-3	vulnerable
	forky	1.14.6+repack-2	vulnerable
	sid	2.1.0+repack-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
hdf5	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/HDFGroup/hdf5/pull/6497
https://github.com/HDFGroup/hdf5/issues/6489
https://github.com/HDFGroup/hdf5/issues/6492
HDF not covered by security support, see https://bugs.debian.org/1117722