CVE-2026-120758 in HDF5
Summary
by MITRE • 11/03/2026
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in HDF5 versions up to 2.2.0 represents a critical memory safety flaw located within the H5HL_unprotect function found in the src/H5HL.c source file. This issue stems from an improper handling of metadata cache entries associated with local heaps, which are fundamental data structures used by HDF5 for storing variable-length data and other complex types. The core technical failure occurs during the lifecycle management of these heap objects, specifically when transitioning between protected and unprotected states within the internal caching mechanism. Under normal operational conditions, the H5HL_protect function is responsible for pinning a single metadata cache entry corresponding to either the heap prefix or its separate data block, ensuring that the object remains resident in memory while it is being accessed or modified by application code. Conversely, the H5HL_unprotect function is designed to unpin this entry upon the final release of access, signaling that the object can potentially be evicted from the cache if memory pressure requires it.
The root cause of the vulnerability lies in a race condition and state inconsistency between metadata destruction routines and the protection management logic. When the metadata cache encounters a corrupted local heap entry, it initiates a cleanup process via H5HL__prfx_dest to unlink the object from the active heap structure. This unlinking operation explicitly sets the pointers for either the heap prefix or the data block within the heap structure to NULL, effectively marking them as invalid and removed from the current operational context. However, due to insufficient state tracking or synchronization errors in certain code paths, a crafted HDF5 file can trigger this destruction sequence while leaving an outstanding reference that subsequently attempts to call H5HL_unprotect. Consequently, the function receives no valid cached object to unpin because the underlying pointer has already been nullified by the preceding cleanup routine.
This logical error results in the passage of a NULL pointer directly into the H5AC_unpin_entry function, which expects a valid memory address representing the cache entry to be unpinned. The operational impact varies significantly depending on the build configuration of the HDF5 library being used. In debug builds, where extensive sanity checks are enabled, this invalid input triggers an assertion failure, causing immediate program termination and providing developers with clear diagnostic information about the internal state violation. However, in release builds intended for production environments, these assertions are disabled to optimize performance, leaving the application vulnerable to a direct NULL pointer dereference. This memory access violation leads to an abrupt crash of the host process or service that is processing the file, resulting in a complete denial of service condition.
From a threat modeling perspective, this vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference, and falls under the broader category of CWE-20, Improper Input Validation, as the library fails to adequately validate the state of internal objects before performing operations on them within the ATT&CK framework. An attacker who possesses the ability to trick a user or an automated application into opening and traversing a maliciously crafted HDF5 file can exploit this flaw to disrupt service availability. The attack vector is primarily local or network-based depending on how the library is integrated, requiring only that the victim system processes the specific malformed input sequence without prior sanitization of the internal heap structures.
Mitigation strategies for this vulnerability must focus on both immediate patching and long-term defensive coding practices. Organizations relying on HDF5 should immediately upgrade to a version later than 2.2.0 where this logic error has been corrected by ensuring that H5HL_unprotect checks for NULL pointers or verifies the validity of the cache entry before attempting to unpin it. Additionally, developers integrating HDF5 into their applications should implement robust input validation at the application layer to detect and reject corrupted files early in the processing pipeline, thereby reducing the attack surface. Enabling core dump analysis during testing phases can also help identify similar state inconsistencies in custom implementations of file handling routines that utilize this library.