CVE-2026-120757
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link's user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.
Risk Assessment
An attacker can crash an application or potentially disclose memory contents, leading to denial of service and confidentiality breach.
Recommendation
Update the HDF5 library to a version later than 2.2.0 and avoid opening untrusted HDF5 files until patched.
Other vulnerabilities in HDF5
See all- CVE-2017-17509High
In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.
- CVE-2016-4333High
The HDF5 1.8.16 library has a vulnerability that allows modification of the loop's index when initializing an array, potentially leading to out-of-bounds access. The value used for space allocation comes from the file, creating a risk of manipulation by an attacker.
- CVE-2016-4332High
The HDF5 library version 1.8.16 fails to check if certain message types support a particular flag, leading to casting the structure to an alternative structure and assigning values to fields not supported by the message type. This can result in code execution under the context of the library.
- CVE-2016-4331High
When decoding data out of a dataset encoded with the H5Z_NBIT decoding, the HDF5 1.8.16 library fails to ensure that the precision is within the bounds of the size, leading to arbitrary code execution.
- CVE-2016-4330High
The HDF5 library version 1.8.16 has a flaw in failing to check if the number of dimensions for an array read from the file is within the bounds of the allocated space. This can lead to a heap-based buffer overflow, potentially allowing arbitrary code execution.
- CVE-2026-120758Medium
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. A crafted HDF5 file can reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(), causing an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.
- CVE-2026-120756Medium
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header has been decoded, so a crafted HDF5 file can cause reads beyond the heap allocation during H5Fopen(). An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
- CVE-2026-120755Medium
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without verifying the chunk is at least 4 bytes long, causing the length calculation to wrap around and the decompressor to read past the chunk buffer. An attacker can cause a denial of service if a user or application reads a dataset from a crafted HDF5 file; only builds with szip support are affected.
- CVE-2026-120754Low
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file, so a truncated chunk passes bounds checks and is decompressed from the uninitialized remainder of the allocation, returning unrelated heap contents as dataset data. The issue is not detected by AddressSanitizer because reads remain within the allocation, and it exists because of an incomplete fix for CVE-2026-19029.
- CVE-2026-120689Medium
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node's level matches the expected level, allowing a crafted HDF5 file to bypass the check and cause unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file.
Original NVD description (English source)
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS