CVE-2026-120756
Hdfgroup hdf5: out-of-bounds read can lead to denial of service
- Risk score
- 42/100
- CVSS
- 6.1 v3.1
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optiona…
- Affected
- Hdfgroup hdf5
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Hdfgroup hdf5: Yellow, plan it in. HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size…
The flaws
- CVE-2026-120756: Out-of-bounds read can lead to denial of service (CVSS 6.1)
- CVE-2026-120757: Out-of-bounds read can lead to denial of service (CVSS 7.1)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Hdfgroup hdf5
Where it stands
- Public proof of concept
Connects to
- Same weakness: Out-of-bounds read (CWE-125). 398 other warnings in 30 days
- Same product: Earlier Hdfgroup hdf5 warnings. 3 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
- Public exploit or proof of concept referenced
References
Original description
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
Last activity 3 Nov 2026. Patch Forecast updates every hour.