{"id":"CVE-2026-120756","title":"Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize","summary":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the rem…","severity":"low","cvss":1.9,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","cvssSource":"cna","cwe":["CWE-125"],"vendor":"The HDF Group","product":"HDF5","affected":["HDF5 < 2.3.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:55:08.252551Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:55:20.773Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120756","references":[{"url":"https://github.com/HDFGroup/hdf5/pull/6589"},{"url":"https://github.com/HDFGroup/hdf5/issues/6401"}],"tags":["cve.org"],"epss":0.00178,"epssPercentile":0.07462,"ingestedAt":"2026-11-05T20:33:06.335Z","slug":"CVE-2026-120756","body":"## Overview\n\nHDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.\n\n## Affected\n\n- `HDF5 < 2.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":10,"depthScoreParts":{"impact":10.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}