CVE-2026-19023 describes an untrusted pointer dereference vulnerability in the render_bin_output function of the h5dump tool in HDF5 versions prior to 2.1.1. When a variable-length string dataset containing more than one element is dumped in binary mode, the stride calculation for each element becomes corrupted. This causes subsequent elements to be read from incorrect offsets and dereferenced as pointers, resulting in a denial of service condition.

Successful exploitation results in a denial of service by crashing the h5dump tool due to invalid pointer dereference. There is no indication of privilege escalation, data disclosure, or code execution from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.1.1, upgrading to version 2.1.1 or later is likely recommended once confirmed. Until then, avoid processing untrusted variable-length string datasets with multiple elements in binary mode using h5dump.