The vulnerability CVE-2026-19023 in HDF5 before version 2.1.1 is caused by an untrusted pointer dereference in the render_bin_output function of the h5dump tool. When dumping variable-length string datasets containing more than one element in binary mode, the per-element stride calculation becomes corrupted. This corruption causes subsequent elements to be read from misaligned offsets and dereferenced as pointers, resulting in a denial of service condition.

Successful exploitation of this vulnerability allows an attacker to cause a denial of service by crashing the h5dump tool when processing specially crafted variable-length string datasets. There is no indication of privilege escalation or code execution. The impact is limited to denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should avoid processing untrusted variable-length string datasets with h5dump in binary mode until a fix is available.