CVE-2026-120756

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120756", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "state": "PUBLISHED", "assignerShortName": "HDFG", "dateReserved": "2026-11-02T21:30:11.241Z", "datePublished": "2026-11-03T15:32:53.768Z", "dateUpdated": "2026-11-03T17:55:20.773Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-11-03T15:32:53.768Z"}, "title": "Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds read", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"vendor": "The HDF Group", "product": "HDF5", "modules": ["Object Header"], "versions": [{"status": "affected", "version": "< 2.3.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message\u2019s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in <code>H5O__chunk_deserialize()</code> in <code>src/H5Ocache.c</code>. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message\u2019s decode callback, for example <code>H5O__mtime_new_decode()</code> in <code>src/H5Omtime.c</code>, to read beyond the heap allocation. The flaw is reachable during <code>H5Fopen()</code> on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.&nbsp;&nbsp;"}]}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6589"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6401"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:55:08.252551Z", "id": "CVE-2026-120756", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:55:20.773Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120756", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:55:08.252551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:55:14.314Z"}}], "cna": {"title": "Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The HDF Group", "modules": ["Object Header"], "product": "HDF5", "versions": [{"status": "affected", "version": "< 2.3.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/HDFGroup/hdf5/pull/6589"}, {"url": "https://github.com/HDFGroup/hdf5/issues/6401"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message\u2019s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.", "supportingMedia": [{"type": "text/html", "value": "HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in <code>H5O__chunk_deserialize()</code> in <code>src/H5Ocache.c</code>. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message\u2019s decode callback, for example <code>H5O__mtime_new_decode()</code> in <code>src/H5Omtime.c</code>, to read beyond the heap allocation. The flaw is reachable during <code>H5Fopen()</code> on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.&nbsp;&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds read"}]}], "providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-11-03T15:32:53.768Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120756", "state": "PUBLISHED", "dateUpdated": "2026-11-03T17:55:20.773Z", "dateReserved": "2026-11-02T21:30:11.241Z", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "datePublished": "2026-11-03T15:32:53.768Z", "assignerShortName": "HDFG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Object Header"], "product": "HDF5", "vendor": "The HDF Group", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*", "matchCriteriaId": "F06D7C52-890B-459A-A282-413132C8D00C", "versionEndIncluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message\u2019s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory."}], "id": "CVE-2026-120756", "lastModified": "2026-11-03T21:09:57.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120756", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:55:08.252551Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:22.940", "references": [{"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "tags": ["Exploit", "Vendor Advisory", "Issue Tracking"], "url": "https://github.com/HDFGroup/hdf5/issues/6401"}, {"source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/HDFGroup/hdf5/pull/6589"}], "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "type": "Secondary"}]}

{"bugzilla": {"description": "hdf5: hdf5: Denial of Service via heap buffer over-read", "id": "2566025", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566025"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in hdf5. When parsing object header messages, insufficient boundary checks can allow an attacker to trigger a heap buffer over-read by convincing a user or application to open a specially crafted file. Successful exploitation could cause the application to crash, resulting in a Denial of Service (DoS), or potentially lead to limited disclosure of process memory."], "mitigation": {"lang": "en:us", "value": "Restrict file access permissions to ensure HDF5 files are ingested exclusively from trusted sources. Run processing applications within sandboxed or containerized environments with strict resource constraints to isolate process termination and mitigate potential memory exposure."}, "name": "CVE-2026-120756", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "hdf5", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hdf5", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "hdf5", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-11-03T15:32:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120756\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120756\nhttps://github.com/HDFGroup/hdf5/issues/6401\nhttps://github.com/HDFGroup/hdf5/pull/6589"], "statement": "A heap-based buffer over-read vulnerability was found in HDF5's H5O__chunk_deserialize() function in src/H5Ocache.c. When decoding object header messages from a crafted file via H5Fopen(), the library validates the declared message size against the chunk boundary before decoding trailing header fields, causing message bodies to offset up to four bytes beyond the checked boundary. An attacker who tricks a user or application into opening a specially crafted HDF5 file can cause an application crash, resulting in a denial of service, or potentially leak limited process memory.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "HDF5", "source": "cna", "vendor": "The HDF Group"}, "product": "hdf5", "vendor": "hdfgroup"}], "created": "2026-11-03T16:45:13.733703+00:00", "updated": "2026-11-03T16:45:14.067448+00:00", "vendors": ["hdfgroup", "hdfgroup$PRODUCT$hdf5"]}