AZL-112640: CVE-2026-120758 affecting package hdf5 1.14.6-6
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect() in src/H5HL.c. H5HLprotect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HLprfxdest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HLunprotect() with no cached object to unpin, and the function passes the NULL pointer to H5ACunpinentry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or applications that open and traverse HDF5 files from untrusted sources are exposed. An attacker needs to provide a crafted HDF5 file and have it processed by the affected software.
What is the impact of successful exploitation?
Successful exploitation causes a denial of service. Debug builds may hit an assertion failure, while release builds may dereference a NULL pointer and crash.
What can be done if an update cannot be applied immediately?
Avoid opening or traversing untrusted HDF5 files until the affected package can be updated. Restrict HDF5 file ingestion to trusted sources where possible.