AZL-112637: CVE-2026-120757 affecting package hdf5 1.14.6-6
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udatasize, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger this issue?
The attacker must supply a crafted HDF5 file with a malformed external link and induce a user or application to traverse that link, such as by opening an object through it. The malformed link data is not NULL-terminated or is too short to contain both required strings.
What impact can occur when a malformed external link is traversed?
The library can read beyond the external-link user-data heap buffer until it encounters a zero byte, causing a denial of service. Adjacent heap data may also be treated as part of the external file name or object path that the library attempts to open.
How can I determine whether an application is exposed?
An application is exposed if it uses an affected HDF5 version and processes HDF5 files from untrusted sources or otherwise may traverse external links in attacker-controlled files. The vulnerable code path is reached when an external link is followed.