{"id":"CVE-2026-19029","published":"2026-10-06T21:17:20.410","lastModified":"2026-10-07T17:16:54.353","description":"A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/HDFGroup/hdf5/pull/6718","tags":[]}],"exploitRefs":[{"url":"https://github.com/HDFGroup/hdf5/pull/6718","tags":[]}],"hasPoc":true,"ai":null}