Read the docs
TI-2026-84384 Aliases CVE-2026-120757GHSA-2qgq-73w8-3hrx

Heap buffer over-read in HDF5 external link traversal

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

HDF5 before 2.3.0 contains a heap buffer over-read in H5L__extern_traverse(), the default traversal callback for external links. The callback calls strlen() on the link's user data without checking its stored size, so a link whose data is not NULL-terminated makes it read past the buffer (CWE-125). A user or application that opens a crafted HDF5 file containing such a link can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Partial HDF5 (The HDF Group): 2.3.0Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The HDF GroupHDF5before 2.3.02.3.0Patch availableCNA
  • HDF5 VendorThe HDF Group Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*up to 2.2.0VulnerableThe HDF Group
  • cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·The HDF Group

Remediation

Upgrade HDF5 to version 2.3.0, which fixes this flaw. Red Hat Hardened Images are fixed by RHSA-2026:94898, released 2026-11-04. Red Hat's plan for Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenStack Platform 13 (Queens) is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA HDF5 (The HDF Group) Fixed in 2.3.0

Red Hat 1 advisory

  • RHSA-2026:94898 Released 2026-11-04 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images hdf5-2.2.0-0.1.5.hum1@aarch64, hdf5-2.2.0-0.1.5.hum1@s390x, hdf5-2.2.0-0.1.5.hum1@src +28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:94898

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-120757
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW
  4. 2026-11-03 Alias added: GHSA-2qgq-73w8-3hrx
  5. 2026-11-03 CVSS score added · NVD
  6. 2026-11-04 Affected versions changed · Red Hat
  7. 2026-11-04 CVSS score added · Red Hat
  8. 2026-11-04 Fix available: RHSA-2026:94898 · Red Hat
  9. 2026-11-04 Fix available: Red Hat Hardened Images · Red Hat

References

Patch 1

  • TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
  • TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
  • TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
  • TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
  • TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
  • TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
See all 140 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences