Uninitialized memory disclosure in HDF5 Scale-Offset filter
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-908 and the CVSS impact.
Summary
The HDF Group's HDF5 Scale-Offset Filter before 2.3.0 reads uninitialized heap memory when it decodes a truncated chunk (CWE-908). The decode path checks reads against the allocated chunk buffer size rather than the bytes read from the file, so unrelated process memory is returned as dataset data. An attacker who gets a user or application to read a dataset from a crafted HDF5 file can disclose process memory. The issue exists because of an incomplete fix for CVE-2026-19029.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The HDF Group | Scale-Offset Filter | before 2.3.0 | 2.3.0 | Patch available | CNA |
- Scale-Offset Filter VendorThe HDF Group Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* | up to 2.2.0 | Vulnerable | The HDF Group |
- cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·The HDF Group
Remediation
Update the HDF5 Scale-Offset Filter to version 2.3.0. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenStack Platform 13 (Queens) as affected with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Scale-Offset Filter (The HDF Group) Fixed in 2.3.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-11-03 Threatist record created from CVE-2026-120754
- 2026-11-03 Alias added: GHSA-j35h-4545-xh77
- 2026-11-03 CVSS score added · NVD
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
More The HDF Group Hdf5 vulnerabilities
- TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
- TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
- TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
- TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
- TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
- TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
Sources
- CVE-2026-120754 · CVE Program
- CVE-2026-120754 · NVD
- FIRST EPSS
- GHSA-j35h-4545-xh77 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-120754 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences