TI-2026-84385 Aliases CVE-2026-120758 GHSA-49fv-ggjg-jcjc

NULL pointer dereference in HDF5 lets crafted files crash the library

LOW 23CWE-476Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

HDF5 before 2.3.0 has a NULL pointer dereference in H5HL_unprotect() in src/H5HL.c. When the metadata cache destroys a corrupted local heap entry, the heap loses its cached prefix or data block, and H5HL_unprotect() then passes a NULL pointer to H5AC_unpin_entry() (CWE-476). A crafted HDF5 file can trigger this, causing an assertion failure in debug builds and a crash in release builds. An attacker who gets a user or application to open and traverse a malicious file can cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0014 3rd percentileScored 2026-11-07

Fix Partial HDF5 (The HDF Group): 2.3.0Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The HDF Group	HDF5	before 2.3.0	2.3.0	Patch available	CNA

HDF5 VendorThe HDF Group Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hdfgroup:hdf5::::::::	up to 2.2.0	Vulnerable	The HDF Group

cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·The HDF Group

Remediation

Upgrade HDF5 to 2.3.0, which fixes the flaw. Red Hat fixes Red Hat Hardened Images in RHSA-2026:94898, released 2026-11-04. Red Hat's plan for Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenStack Platform 13 (Queens) is none available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA HDF5 (The HDF Group) Fixed in 2.3.0

Red Hat 1 advisory

RHSA-2026:94898 Released 2026-11-04 · Red Hat rating Moderate
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images hdf5-2.2.0-0.1.5.hum1@aarch64, hdf5-2.2.0-0.1.5.hum1@s390x, hdf5-2.2.0-0.1.5.hum1@src +28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:94898

Timeline

2026-11-03 Threatist record created from CVE-2026-120758
2026-11-03 CISA SSVC decision points changed
2026-11-03 Priority changed: MEDIUM → LOW
2026-11-03 Alias added: GHSA-49fv-ggjg-jcjc
2026-11-03 CVSS score added · NVD
2026-11-04 Affected versions changed · Red Hat
2026-11-04 CVSS score added · Red Hat
2026-11-04 Fix available: RHSA-2026:94898 · Red Hat
2026-11-04 Fix available: Red Hat Hardened Images · Red Hat

References

Patch 1

https://github.com/HDFGroup/hdf5/pull/6377

TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8

See all 140 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences