---
id: "CVE-2026-120757"
kind: "vulnerability"
aliases: ["CVE-2026-120757"]
title: "HDF5: crafted external link causes heap over-read when traversed"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "hdf5", "package", "python", "scientific-computing"]
not_affected_if: ["no-external-links", "trusted-files-only"]
published_at: "2026-11-03T16:17:23+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:23:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120757", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# HDF5: crafted external link causes heap over-read when traversed

HDF5 through 2.2.0 reads past the end of a heap buffer when it traverses an external link in a crafted file. An attacker who gets a user or application to open such a file can crash the program and may leak adjacent heap contents into the external file name the library tries to open.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HDF5 library version against the affected range (through `2.2.0`).
- Find applications that open HDF5 files from untrusted sources, since traversal of external links is what triggers the flaw.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120757

## From the sources

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_