AZL-112658: CVE-2026-120754 affecting package hdf5 1.14.6-6
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5Dchunklock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications or users that read datasets from crafted HDF5 files are exposed. Successful exploitation can disclose unrelated memory from the process handling the file.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause a user or application to read a dataset from a specially crafted, truncated HDF5 file. The vulnerability occurs in the scale-offset filter decode path.
Can AddressSanitizer detect exploitation of this issue?
No. The reads remain within the allocated chunk buffer, so AddressSanitizer does not detect the uninitialized-memory read.
What is the relationship to CVE-2026-19029?
This issue exists because the fix for CVE-2026-19029 was incomplete.