CVE-2026-19024 is a high-severity vulnerability in The HDF Group's HDF5 library, affecting versions prior to 2.1.1. The issue arises in the H5Pget_fill_value function when it processes datasets whose fill value message version 1 or 2 has the "defined" flag set alongside a negative size field. This negative size is not normalized to the library's "undefined" sentinel value, causing the function H5T_path_find to be called with a NULL datatype pointer. This results in a NULL pointer dereference, which can cause the application to crash, leading to denial of service.

Successful exploitation causes a denial of service by crashing the application using the vulnerable HDF5 library. There is no indication of privilege escalation, data corruption, or information disclosure. The attack requires local access (AV:L) and user interaction (UI:P), with no privileges required (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted datasets with version 1 or 2 fill value messages that have the "defined" flag set and a negative size field. Monitor vendor communications for updates and apply patches promptly once released.