Live › vulnerability › CVE-2026-120689
A crafted HDF5 file whose version 1 B-tree points a child back at a node already cached causes the library to recurse without limit in H5B__iterate_helper(). Opening the file and calling H5Gget_info() or H5Gget_num_objs() on a group exhausts the stack and crashes the application, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Applications that link the HDF5 library through version 2.2.0 and open HDF5 files supplied by others, then query group information. Systems that only read files they generate themselves are unlikely to be exposed. unknown whether a patched version exists in the sources.
No product ranges from the sources yet.
2.2.0 are affected.H5Gget_info() or H5Gget_num_objs().No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120689")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.