High CVSS 8.2
CVE-2026-19024
NVD analysis in progress
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype.
What this means
- Exposure
- Exploitable with local access to the machine and without authentication — but only if a user opens booby-trapped content.
- Impact
- An attacker can take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- A null pointer is dereferenced and the service stops.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.