TI-2026-84382 Aliases CVE-2026-120755 GHSA-63qm-xvf9-v4m8

Out-of-bounds read in HDF5 Szip filter on truncated chunks

LOW 21CWE-125Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

HDF5 through 2.2.0 has an out-of-bounds read in H5Z__filter_szip() when decoding szip-compressed chunks. It subtracts the 4-byte length header without checking that the chunk is at least 4 bytes, so a truncated chunk wraps the length and the decompressor reads past the buffer (CWE-125). An attacker who gets a user to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0014 3rd percentileScored 2026-11-07

Fix Partial Szip Filter (The HDF Group): 2.3.0Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The HDF Group	Szip Filter	before 2.3.0	2.3.0	Patch available	CNA

Szip Filter VendorThe HDF Group Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hdfgroup:hdf5::::::::	up to 2.2.0	Vulnerable	The HDF Group

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·The HDF Group

Remediation

Upgrade Szip Filter to 2.3.0, the fixed version. Red Hat's plan for Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images and Red Hat OpenStack Platform 13 (Queens) is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Szip Filter (The HDF Group) Fixed in 2.3.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet: Fix deferred

Timeline

2026-11-03 Threatist record created from CVE-2026-120755
2026-11-03 CISA SSVC decision points changed
2026-11-03 Alias added: GHSA-63qm-xvf9-v4m8
2026-11-03 CVSS score added · NVD
2026-11-04 Affected versions changed · Red Hat
2026-11-04 CVSS score added · Red Hat

References

Patch 1

https://github.com/HDFGroup/hdf5/pull/6585

TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8

See all 140 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences