CVE-2026-120756
Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize
Description
HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.
INFO
Published Date :
Nov. 3, 2026, 4:17 p.m.
Last Modified :
Nov. 3, 2026, 9:09 p.m.
Remotely Exploit :
No
Source :
0253b833-3e77-4dfe-9d57-17db1a2f0a74
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | LOW | 0253b833-3e77-4dfe-9d57-17db1a2f0a74 | ||||
| CVSS 4.0 | LOW | 0253b833-3e77-4dfe-9d57-17db1a2f0a74 |
Solution
- Update HDF5 to a version that fixes the vulnerability.
- Ensure proper input validation for HDF5 file structures.
- Review HDF5 file parsing and deserialization logic.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-120756.
| URL | Resource |
|---|---|
| https://github.com/HDFGroup/hdf5/issues/6401 | Exploit Vendor Advisory Issue Tracking |
| https://github.com/HDFGroup/hdf5/pull/6589 | Issue Tracking Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-120756 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-120756
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-120756 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-120756 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 03, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Added CPE Configuration OR *cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* versions up to (including) 2.2.0 Added Reference Type HDFG: https://github.com/HDFGroup/hdf5/issues/6401 Types: Exploit, Issue Tracking, Vendor Advisory Added Reference Type HDFG: https://github.com/HDFGroup/hdf5/pull/6589 Types: Issue Tracking, Patch -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Nov. 03, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-120756', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-11-03T17:55:08.252551Z'} -
New CVE Received by 0253b833-3e77-4dfe-9d57-17db1a2f0a74
Nov. 03, 2026
Action Type Old Value New Value Added Description HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-125 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/120xxx/CVE-2026-120756.json">CVE-2026-120756</a> Added Reference https://github.com/HDFGroup/hdf5/issues/6401 Added Reference https://github.com/HDFGroup/hdf5/pull/6589