AZL-112634: CVE-2026-120756 affecting package hdf5 1.14.6-6
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Ochunkdeserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5Omtimenewdecode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications or users that open HDF5 files from untrusted sources are exposed. The vulnerable parsing path is reached when H5Fopen() processes a crafted file.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a malicious HDF5 file and cause a user or application to open it. No network-based attack path is described.
What is the likely security impact?
Successful exploitation can cause a denial of service or limited disclosure of process memory through a heap buffer over-read.