CVE-2026-120754

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120754", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "state": "PUBLISHED", "assignerShortName": "HDFG", "dateReserved": "2026-11-02T21:30:10.354Z", "datePublished": "2026-11-03T15:24:09.708Z", "dateUpdated": "2026-11-03T17:58:54.979Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-11-03T15:28:08.070Z"}, "title": "Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-908", "description": "CWE-908 Use of uninitialized resource", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"vendor": "The HDF Group", "product": "Scale-Offset Filter", "versions": [{"status": "affected", "version": "< 2.3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in <code>H5Z__filter_scaleoffset()</code> in <code>src/H5Zscaleoffset.c</code>. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because <code>H5D__chunk_lock()</code> deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.&nbsp;&nbsp;"}]}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6585"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:58:34.405337Z", "id": "CVE-2026-120754", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:58:54.979Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:58:34.405337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:58:40.999Z"}}], "cna": {"title": "Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The HDF Group", "product": "Scale-Offset Filter", "versions": [{"status": "affected", "version": "< 2.3.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6585"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.", "supportingMedia": [{"type": "text/html", "value": "HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in <code>H5Z__filter_scaleoffset()</code> in <code>src/H5Zscaleoffset.c</code>. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because <code>H5D__chunk_lock()</code> deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.&nbsp;&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "CWE-908 Use of uninitialized resource"}]}], "providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-11-03T15:28:08.070Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120754", "state": "PUBLISHED", "dateUpdated": "2026-11-03T17:58:54.979Z", "dateReserved": "2026-11-02T21:30:10.354Z", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "datePublished": "2026-11-03T15:24:09.708Z", "assignerShortName": "HDFG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Scale-Offset Filter", "vendor": "The HDF Group", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*", "matchCriteriaId": "F06D7C52-890B-459A-A282-413132C8D00C", "versionEndIncluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029."}], "id": "CVE-2026-120754", "lastModified": "2026-11-03T21:10:24.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120754", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:58:34.405337Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:22.627", "references": [{"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/HDFGroup/hdf5/pull/6585"}], "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}]}

{"bugzilla": {"description": "hdf5: hdf5: Information disclosure via uninitialized memory read", "id": "2566026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566026"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in HDF5. This vulnerability allows an attacker to cause information disclosure by convincing a user or application to process a specially crafted HDF5 file. During decompression, bounds checks incorrectly evaluate the buffer's total allocated size rather than the actual amount of data read, resulting in an uninitialized memory read. Consequently, unrelated heap memory contents can be returned, potentially exposing sensitive process data."], "mitigation": {"lang": "en:us", "value": "Restrict file access permissions to ensure HDF5 files are ingested exclusively from verified, trusted sources. Isolate applications decompressing untrusted HDF5 files inside containerized or memory-constrained sandbox environments to minimize the sensitivity of process memory exposed."}, "name": "CVE-2026-120754", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "hdf5", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hdf5", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "hdf5", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-11-03T15:24:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120754\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120754\nhttps://github.com/HDFGroup/hdf5/pull/6585"], "statement": "An uninitialized memory read vulnerability was found in HDF5's H5Z__filter_scaleoffset() function in src/H5Zscaleoffset.c. When decompressing a dataset from a crafted HDF5 file containing a truncated chunk, the library validates reads against the allocated chunk buffer size rather than the actual bytes read, returning uninitialized heap memory to the caller. An attacker who convinces a user or application to read a dataset from a specially crafted HDF5 file can trigger this flaw to leak sensitive process memory.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Scale-Offset Filter", "source": "cna", "vendor": "The HDF Group"}, "product": "scale-offset_filter", "vendor": "the_hdf_group"}], "created": "2026-11-03T16:45:14.068109+00:00", "updated": "2026-11-06T21:41:36.937878+00:00", "vendors": ["the_hdf_group", "the_hdf_group$PRODUCT$scale-offset_filter"]}