CVSS 4.0
6.9 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-120757
Medium (6.9) in hdfgroup hdf5. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
On this page
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.
Severity
CVSS 3.1
7.1 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 4th percentile. Scored 2026-11-04. A forecast for this CVE across the internet, not for your own systems.
- CISA's assessment (SSVC)
- Exploitation: none · Automatable: no · Technical impact: partial, assessed 2026-11-03. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
- CWE
- CWE-125 Out-of-bounds Read
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-120757 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120757?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120757?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-120757 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Affected
Versions
From the NVD's CPE matches.
| Product | Affected |
|---|---|
| hdfgroup:hdf5 | through 2.2.0 |
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120757 |
| Azure Linux | 3 | hdf5 | no fix listed | AZL-112637 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Microsoft's Azure Linux vulnerability data, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian.
Red Hat
Red Hat rates this Moderate.
A heap-based buffer over-read vulnerability was found in HDF5's H5L__extern_traverse() callback when handling external links. When traversing an external link with missing null-termination or insufficient buffer length, strlen() reads past the boundary of the allocated user data heap buffer. An attacker who convinces a user or service to open a specially crafted HDF5 file can cause an application crash, resulting in a denial of service, or potentially leak adjacent heap memory.
Restrict file permissions and do not process HDF5 files from untrusted or unverified sources. When automated parsing is required, isolate the processing application within a constrained sandbox or container environment to limit the impact of process termination or memory leakage.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | hdf5 | Fix deferred | |
| Red Hat Hardened Images | hdf5 | Affected | |
| Red Hat OpenStack Platform 13 (Queens) | hdf5 | Fix deferred |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-120757.
Attack patterns (CAPEC)
- CAPEC-540 Overread Buffers Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.