CVE-2026-120499: h5io before 0.2.6 Arbitrary Code Execution via read_hdf5

Published Nov 5, 2026

Updated

h5io before 0.2.6 contains a code injection vulnerability in readhdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which triageread() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that importclass() imports, or place pickled objects in pddataframe or pdseries nodes that pandas deserializes on read.

Event History

Nov 5, 2026

CVE Published

via MITRE·04:55 PM

Data Sourced

via MITRE·04:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Any environment using h5io before 0.2.6 that calls read_hdf5() on HDF5 files from an untrusted or attacker-controlled source is exposed. Exploitation occurs during file reading, so systems that only create files are not described as affected by this issue.

What does an attacker need to exploit it?

The attacker needs to provide a crafted HDF5 file and have a user or process read it with read_hdf5(). No privileges are required according to the supplied vector, but user interaction is required to cause the malicious file to be read.

Are multiple HDF5 node types dangerous?

Yes. A malicious timezone node can supply Python code to eval(), class or custom-object nodes can cause an arbitrary module import, and pd_dataframe or pd_series nodes can contain pickled objects deserialized by pandas.

What is the available remediation?

Upgrade h5io to version 0.2.6 or later. If upgrading cannot happen immediately, do not process untrusted HDF5 files with read_hdf5().

CVE-2026-120499: h5io before 0.2.6 Arbitrary Code Execution via read_hdf5

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are multiple HDF5 node types dangerous?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are multiple HDF5 node types dangerous?

What is the available remediation?