HDF Group HDF5 up to 2.2.x Object Header Decoding src/H5Ocache.c H5O__chunk_deserialize heap-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in HDF Group HDF5 up to 2.2.x. The impacted element is the function H5O__chunk_deserialize of the file src/H5Ocache.c of the component Object Header Decoding. The manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-120756. The attack can only be performed from a local environment. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in HDF Group HDF5 up to 2.2.x. It has been rated as problematic. This issue affects the function H5O__chunk_deserialize of the file src/H5Ocache.c of the component Object Header Decoding. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-120756 since 11/02/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

It is declared as proof-of-concept.

Upgrading to version 2.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• HDF Group

Name

• HDF5

Version

• 2.0
• 2.1
• 2.2

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion