Live › vulnerability › CVE-2026-120758
A crafted HDF5 file makes the HDF5 library dereference a NULL pointer in H5HL_unprotect() while reading a corrupted local heap. The result is a crash, a denial of service for any program that opens and traverses the file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Any application that links the HDF5 library through version 2.2.0 and opens HDF5 files that may be attacker-supplied can crash when a malicious file is traversed. Applications that only read trusted, locally produced HDF5 files are much less exposed. The sources do not state a fixed version.
No product ranges from the sources yet.
h5dump --version or the version reported by your build; versions through 2.2.0 are affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120758")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.