Live › vulnerability › CVE-2026-120756
HDF5 through 2.2.0 checks an object header message size before reading its flags and creation index, so a crafted file can make the library read past a heap buffer. An attacker who gets a user or application to open a malicious HDF5 file can crash the process or read limited process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Applications and tools that open HDF5 files supplied by users or other systems can be exposed, since the flaw triggers during H5Fopen() on a crafted file. Systems that only open trusted, internally generated HDF5 files are much less exposed. The sources do not say which HDF5 release fixes it.
No product ranges from the sources yet.
through 2.2.0).H5Fopen() on files that come from outside the organization.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-120756")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.