CVE-2026-120758: NULL Pointer Dereference in H5HL_unprotect via Corrupted File

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect() in src/H5HL.c. H5HLprotect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HLprfxdest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HLunprotect() with no cached object to unpin, and the function passes the NULL pointer to H5ACunpinentry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.