HDF Group HDF5 up to 2.2.x External Link Traversal src/H5Lexternal.c H5L__extern_traverse heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in HDF Group HDF5 up to 2.2.x. Affected is the function H5L__extern_traverse of the file src/H5Lexternal.c of the component External Link Traversal. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2026-120757. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in HDF Group HDF5 up to 2.2.x. Affected by this issue is the function H5L__extern_traverse of the file src/H5Lexternal.c of the component External Link Traversal. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-120757 since 11/02/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 2.3.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• HDF Group

Name

• HDF5

Version

• 2.0
• 2.1
• 2.2

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion