This Red Hat security advisory updates several hdf5 RPM packages in Red Hat Hardened Images to fix three security vulnerabilities identified by CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. The advisory lists updated package versions (2.2.0-0.1.2.hum1) for multiple hdf5 variants across aarch64 and x86_64 architectures. The advisory does not provide detailed technical descriptions of the vulnerabilities but references CWE-476 (NULL Pointer Dereference) and CWE-125 (Out-of-bounds Read). No CVSS scores are provided. The update is available from Red Hat's public repositories and is intended to mitigate these vulnerabilities.

The vulnerabilities affect the hdf5 packages in Red Hat Hardened Images and could potentially lead to issues related to NULL pointer dereferences or out-of-bounds reads, which may cause crashes or information disclosure. The advisory classifies the severity as medium. There are no known exploits in the wild at the time of publication.

Red Hat has released updated hdf5 RPM packages (version 2.2.0-0.1.2.hum1) that address the identified vulnerabilities. Users of affected Red Hat Hardened Images should apply these updates by upgrading to the provided package versions from the official Red Hat repositories. No additional mitigation steps are indicated or required beyond applying the update.