An update for hdf5 is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4459 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 hdf5 security update An update for hdf5 is now available for openEuler-22.03-LTS-SP4 HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and applications for managing, manipulating, viewing, and analyzing data in the HDF5 format. Security Fix(es): Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.(CVE-2026-19023) NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.(CVE-2026-19024) H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools.(CVE-2026-19026) The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.(CVE-2026-19027) H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools.(CVE-2026-19028) An update for hdf5 is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High hdf5 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19023 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19024 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19026 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19027 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19028 https://nvd.nist.gov/vuln/detail/CVE-2026-19023 https://nvd.nist.gov/vuln/detail/CVE-2026-19024 https://nvd.nist.gov/vuln/detail/CVE-2026-19026 https://nvd.nist.gov/vuln/detail/CVE-2026-19027 https://nvd.nist.gov/vuln/detail/CVE-2026-19028 openEuler-22.03-LTS-SP4 hdf5-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-debuginfo-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-debugsource-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-devel-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-mpich-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-mpich-devel-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-mpich-static-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-openmpi-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-openmpi-devel-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-openmpi-static-1.14.5-8.oe2203sp4.aarch64.rpm hdf5-1.14.5-8.oe2203sp4.src.rpm hdf5-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-debuginfo-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-debugsource-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-devel-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-mpich-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-mpich-devel-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-mpich-static-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-openmpi-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-openmpi-devel-1.14.5-8.oe2203sp4.x86_64.rpm hdf5-openmpi-static-1.14.5-8.oe2203sp4.x86_64.rpm Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer. 2026-10-22 CVE-2026-19023 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X hdf5 security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459 NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.1.1 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype. 2026-10-22 CVE-2026-19024 openEuler-22.03-LTS-SP4 High 8.2 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X hdf5 security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459 H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools. 2026-10-22 CVE-2026-19026 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X hdf5 security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459 The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools. 2026-10-22 CVE-2026-19027 openEuler-22.03-LTS-SP4 Medium 6.9 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X hdf5 security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459 H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. 2026-10-22 CVE-2026-19028 openEuler-22.03-LTS-SP4 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X hdf5 security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4459