HDF Group HDF5 prior 2.3.0 src/H5B.c H5B__iterate_helper recursion

Summaryinfo

A vulnerability, which was classified as problematic, was found in HDF Group HDF5 prior 2.3.0. This affects the function H5B__iterate_helper of the file src/H5B.c. Such manipulation leads to recursion. This vulnerability is traded as CVE-2026-120689. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in HDF Group HDF5 prior 2.3.0 and classified as problematic. Affected by this issue is the function H5B__iterate_helper of the file src/H5B.c. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. CVE summarizes:

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-120689 since 11/02/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• HDF Group

Name

• HDF5

Version

• <2.3.0

License

• free

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion