---
id: "CVE-2026-120689"
kind: "vulnerability"
aliases: ["CVE-2026-120689"]
title: "HDF5: crafted file triggers unbounded recursion and crashes the reader"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "data-pipelines", "hdf5", "package", "scientific-computing"]
not_affected_if: ["trusted-files-only"]
published_at: "2026-11-02T20:17:41+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:36:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120689", "first_seen_at": "2026-11-02T20:35:26+00:00"}]
---

# HDF5: crafted file triggers unbounded recursion and crashes the reader

A crafted HDF5 file whose version 1 B-tree points a child back at a node already cached causes the library to recurse without limit in H5B__iterate_helper(). Opening the file and calling H5Gget_info() or H5Gget_num_objs() on a group exhausts the stack and crashes the application, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the HDF5 library version in use; the sources say versions through `2.2.0` are affected.
- Look for applications that open HDF5 files from untrusted sources and call `H5Gget_info()` or `H5Gget_num_objs()`.

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120689

## From the sources

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_