HDF Group HDF5 up to 2.2.0 Scale-Offset Filter src/H5Zscaleoffset.c H5Z__filter_scaleoffset uninitialized pointer

Summaryinfo

A vulnerability identified as problematic has been detected in HDF Group HDF5 up to 2.2.0. This affects the function H5Z__filter_scaleoffset of the file src/H5Zscaleoffset.c of the component Scale-Offset Filter. Performing a manipulation results in uninitialized pointer. This vulnerability was named CVE-2026-120754. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in HDF Group HDF5 up to 2.2.0. This affects the function H5Z__filter_scaleoffset of the file src/H5Zscaleoffset.c of the component Scale-Offset Filter. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. CWE is classifying the issue as CWE-824. The product accesses or uses a pointer that has not been initialized. This is going to have an impact on confidentiality. The summary by CVE is:

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-120754 since 11/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

It is declared as proof-of-concept.

Upgrading to version 2.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• HDF Group

Name

• HDF5

Version

• 2.0
• 2.1
• 2.2.0

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion