CVE-2026-120757 in HDF5
Summary
by MITRE • 11/03/2026
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in HDF5 versions up to 2.2.0 represents a critical memory safety flaw located within the H5L__extern_traverse function found in src/H5Lexternal.c. This specific routine serves as the default traversal callback for external links, which are references pointing to objects stored in separate files rather than within the current HDF5 hierarchy. The core technical deficiency lies in how the library processes user data associated with these external link structures. Specifically, when attempting to locate the target file name and object path contained within the link's user data buffer, the implementation relies on strlen() to determine string boundaries without performing any prior validation against the stored size of that buffer, known as udata_size. Notably, this size parameter was marked as unused in the code logic, effectively bypassing essential bounds checking mechanisms that should prevent access beyond allocated memory regions.
This architectural oversight leads directly to a heap buffer over-read condition when processing malformed input. If an attacker crafts an HDF5 file containing an external link where the associated data is either not null-terminated or is shorter than required to hold both the expected string components, strlen() will read past the end of the allocated udata heap buffer. The overrun is unbounded in nature, meaning it continues reading memory until a zero byte is encountered somewhere in adjacent heap space. Furthermore, because the derived pointers for the object path and file name are calculated based on these invalid lengths, they may also point to addresses outside the legitimate bounds of the original buffer. This creates a scenario where arbitrary heap contents can be interpreted as valid string data by the application logic attempting to open or traverse the link.
The operational impact of this vulnerability is significant, primarily manifesting as a denial of service against applications that utilize HDF5 libraries for file processing. When a user or automated system attempts to access an object through such a crafted external link, the library triggers the out-of-bounds read during traversal. Depending on the memory layout and runtime environment, this can lead to application crashes due to segmentation faults if the accessed memory is unmapped, or it may result in information disclosure where sensitive data from adjacent heap allocations is inadvertently incorporated into the file name or object path strings. This leakage of internal state could potentially aid further exploitation attempts by revealing pointers or other critical structures within the process memory space.
From a classification perspective, this flaw aligns with CWE-125, which describes out-of-bounds read vulnerabilities resulting from improper validation of array indices or buffer sizes. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates reconnaissance and potential privilege escalation vectors by allowing an attacker to leak memory contents through a crafted file input mechanism. The attack vector is classified as local or remote depending on the deployment context, but it fundamentally relies on social engineering or supply chain compromise to get a victim application to open the malicious HDF5 artifact.
Mitigation strategies must focus on immediate patching and defensive coding practices. Organizations using affected versions of HDF5 should upgrade to version 2.2.1 or later where this issue has been addressed by implementing proper bounds checking before invoking strlen() on user data buffers. For environments unable to update immediately, input validation at the application layer is recommended; developers should ensure that any external link metadata processed by custom wrappers includes explicit length checks and null-termination verification before passing it to the library functions. Additionally, enabling AddressSanitizer during testing phases can help detect similar memory safety issues in other parts of HDF5-dependent codebases before they reach production environments.