CVE-2026-26199: Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way where size can be forced to zero, and there is important data before the name buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26199?
CVE-2026-26199 has a risk rating of 37, indicating it could be critical depending on the context of the usage.
What causes CVE-2026-26199?
CVE-2026-26199 is caused by a buffer underflow in the H5Iget_name function when the size parameter is set to zero.
How do I fix CVE-2026-26199?
To fix CVE-2026-26199, ensure that the size parameter passed to the H5Iget_name function is always greater than zero.
Which software is affected by CVE-2026-26199?
CVE-2026-26199 affects the HDF5 library maintained by the HDF Group.
Is there a workaround for CVE-2026-26199?
Currently, the most effective workaround for CVE-2026-26199 is to prevent use of the H5Iget_name function with a size parameter of zero.