---
id: CVE-2026-120754
title: >-
  Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset
  Filter
summary: >-
  HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in
  H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates
  reads against the allocated size of the chunk buffer rather than the number of
  bytes a…
severity: low
cvss: 1.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'
cvssSource: cna
cwe:
  - CWE-908
vendor: The HDF Group
product: Scale-Offset Filter
affected:
  - scale-offset_filter < 2.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:58:34.405337Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:58:54.979Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120754'
references:
  - url: 'https://github.com/HDFGroup/hdf5/pull/6585'
tags:
  - cve.org
epss: 0.00145
epssPercentile: 0.03816
ingestedAt: '2026-11-05T20:33:06.333Z'
---

## Overview

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

## Affected

- `scale-offset_filter < 2.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.