AZL-112526: CVE-2026-120689 affecting package hdf5 1.14.6-6
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5Biteratehelper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5Bcachedeserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Ggetinfo() or H5Ggetnumobjs() on a group in the crafted file, which reaches H5Biterate() through H5Gobjinfo() and H5Gstabcount(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the affected HDF5 package that open HDF5 files from untrusted sources are exposed. The attacker must be able to cause a user or application to open a crafted HDF5 file.
What application behavior can trigger the crash?
The issue can be triggered when H5Gget_info() or H5Gget_num_objs() is called on a group in a crafted file. These calls can reach the vulnerable B-tree iteration path and exhaust the stack.
What is the impact of successful exploitation?
Successful exploitation causes unbounded recursion and stack exhaustion, resulting in an application crash and denial of service.