CVSS 4.0
1.9 lowCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:PCVE-2026-120756
Low (1.9) in hdfgroup hdf5. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
On this page
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
Severity
CVSS 3.1
6.1 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 7th percentile. Scored 2026-11-04. A forecast for this CVE across the internet, not for your own systems.
- CISA's assessment (SSVC)
- Exploitation: none · Automatable: no · Technical impact: partial, assessed 2026-11-03. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
- CWE
- CWE-125 Out-of-bounds Read
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-120756 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120756?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120756?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-120756 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Affected
Versions
From the NVD's CPE matches.
| Product | Affected |
|---|---|
| hdfgroup:hdf5 | through 2.2.0 |
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120756 |
| Azure Linux | 3 | hdf5 | no fix listed | AZL-112634 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Microsoft's Azure Linux vulnerability data, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian.
Red Hat
Red Hat rates this Moderate.
A heap-based buffer over-read vulnerability was found in HDF5's H5O__chunk_deserialize() function in src/H5Ocache.c. When decoding object header messages from a crafted file via H5Fopen(), the library validates the declared message size against the chunk boundary before decoding trailing header fields, causing message bodies to offset up to four bytes beyond the checked boundary. An attacker who tricks a user or application into opening a specially crafted HDF5 file can cause an application crash, resulting in a denial of service, or potentially leak limited process memory.
Restrict file access permissions to ensure HDF5 files are ingested exclusively from trusted sources. Run processing applications within sandboxed or containerized environments with strict resource constraints to isolate process termination and mitigate potential memory exposure.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | hdf5 | Fix deferred | |
| Red Hat Hardened Images | hdf5 | Affected | |
| Red Hat OpenStack Platform 13 (Queens) | hdf5 | Fix deferred |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-120756.
Attack patterns (CAPEC)
- CAPEC-540 Overread Buffers Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.