Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

The vulnerability exists in the H5O__layout_decode() function of the HDF5 library, where it fails to validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank. An attacker can exploit this by crafting a malicious HDF5 file with mismatched dimensionality. When processed by functions like H5Dopen2() or utilities such as h5repack, this leads to a divide-by-zero arithmetic exception in H5S__hyper_iter_get_seq_list(), causing an immediate application crash and denial of service. The issue is tracked as CVE-2026-19025 and affects multiple RPM packages of HDF5 in Red Hat Hardened Images for aarch64 and x86_64 architectures.

The vulnerability causes a denial of service by crashing applications that open or read specially crafted malicious HDF5 files. There is no impact on confidentiality or integrity, but availability is severely affected due to application crashes triggered by the divide-by-zero error.

Red Hat advises not to open or process untrusted HDF5 files using applications or utilities linked against vulnerable versions of the HDF5 library. Only open files from trusted sources or isolate untrusted file parsing in sandboxed environments. As of the advisory date, no official fix has been released; users should monitor Red Hat advisories for updates and apply patches once available.