UBUNTU-CVE-2026-120689: Medium severity ubuntu/hdf5 vulnerability
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5Biteratehelper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5Bcachedeserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Ggetinfo() or H5Ggetnumobjs() on a group in the crafted file, which reaches H5Biterate() through H5Gobjinfo() and H5Gstabcount(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the crash?
The attacker must persuade a user or application to open a crafted HDF5 file and cause group information to be queried. Calls to H5Gget_info() or H5Gget_num_objs() on a group in that file can trigger the vulnerable B-tree iteration.
What is the practical impact?
A malformed version 1 B-tree can cause unbounded recursion and exhaust the stack, crashing the affected process. The provided data describes a denial-of-service impact, not confidentiality or integrity impact.
Why can the malformed B-tree bypass validation?
The child-level check occurs when a node is first loaded into the metadata cache. A crafted child pointer that refers to a node already in the cache, including a self-reference, bypasses that check during iteration.