Red Hat Security Advisory

RHSA-2026:94898

Red Hat Hardened Images RPMs Security Update

Released 2026-11-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images hdf5-2.2.0-0.1.5.hum1@aarch64, hdf5-2.2.0-0.1.5.hum1@s390x, hdf5-2.2.0-0.1.5.hum1@src +28

Fixes 3 records

TI-2026-84384 CVE-2026-120757 · GHSA-2qgq-73w8-3hrx

Heap buffer over-read in HDF5 external link traversal

LOW 29

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links.

CVSS 4.0MEDIUM 6.9 Local No auth User interaction EPSS 0.00152 Published 2026-11-03 Partial fix · 2.3.0 CWE-125

TI-2026-84385 CVE-2026-120758 · GHSA-49fv-ggjg-jcjc

NULL pointer dereference in HDF5 lets crafted files crash the library

LOW 23

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c.

CVSS 4.0MEDIUM 5.4 Local No auth User interaction EPSS 0.0014 Published 2026-11-03 Partial fix · 2.3.0 CWE-476

TI-2026-84383 CVE-2026-120756 · GHSA-m9xj-6f2h-rx5r

Heap buffer over-read in HDF5 object header parsing

LOW 10

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c.

CVSS 4.0LOW 1.9 Local No auth User interaction EPSS 0.00178 Published 2026-11-03 Partial fix · 2.3.0 CWE-125