CVE-2026-120689 in HDF5
Summary
by MITRE • 11/02/2026
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in HDF5 versions up to 2.2.0 represents a critical uncontrolled recursion flaw located within the B-tree iteration logic, specifically in the H5B__iterate_helper function found in src/H5B.c. This component is responsible for traversing version 1 B-trees used by the library to manage metadata structures such as groups and datasets. The core technical deficiency lies in a missing validation check during the iterative traversal process. While the code correctly verifies that a child node’s level matches the expected level when initially loading nodes into the metadata cache via H5B__cache_deserialize, this same verification is omitted during subsequent iterations through H5B_iterate and its helper functions. This inconsistency creates a gap in input validation where malformed data structures can exploit the lack of runtime checks on pointer integrity relative to their hierarchical position.
When an attacker crafts an HDF5 file containing a B-tree with circular references or self-referential pointers, they can bypass the initial cache deserialization check because those nodes are already present in memory when accessed during iteration. As H5B__iterate_helper processes these maliciously constructed node pointers, it fails to detect that the child node’s level does not align with expectations for a valid tree structure. Consequently, the function recursively calls itself indefinitely as it attempts to traverse down into what appears to be another layer of the B-tree but is actually a reference back to an existing node or creates an infinite loop within the recursion stack. This unbounded recursion rapidly consumes available system memory on the call stack, leading directly to stack exhaustion and application crash.
The operational impact of this vulnerability is primarily a denial of service against applications that utilize HDF5 for data storage and retrieval. An attacker who can persuade a user or automated process to open a maliciously crafted file can trigger this flaw by invoking functions such as H5Gget_info() or H5Gget_num_objs(). These high-level API calls internally route through group object information routines like H5G__obj_info and stability counting mechanisms like H5G__stab_count, which eventually reach the vulnerable H5B_iterate function. The result is a complete termination of the application process due to stack overflow, disrupting service availability without requiring any further exploitation steps such as code execution or privilege escalation.
From a classification perspective, this vulnerability aligns with CWE-674, Uncontrolled Recursion, where software does not properly control the depth of recursive calls, leading to resource exhaustion. It also maps to ATT&CK technique T1499, Endpoint Denial of Service, specifically under subcategories involving application or service disruption via memory consumption techniques like stack exhaust. The attack vector is classified as Local with a requirement for user interaction to open the file, though in automated environments this could be achieved through scheduled tasks or unattended processing pipelines that accept external inputs without sufficient sanitization.
Mitigation strategies should focus on immediate patching of HDF5 libraries to versions greater than 2.2.0 where this logic error has been corrected by enforcing level consistency checks during iteration as well as during cache deserialization. For environments unable to upgrade immediately, defensive coding practices such as implementing explicit recursion depth limits or stack size monitoring within the application layer can provide a temporary buffer against exploitation. Additionally, input validation mechanisms should be strengthened at file ingestion points to detect and reject HDF5 files with anomalous metadata structures before they are processed by vulnerable library functions. Security teams should also monitor for abnormal memory usage patterns in applications handling untrusted HDF5 inputs as an indicator of potential exploitation attempts.