---
id: CVE-2026-120757
title: Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
summary: >-
  HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in
  H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback
  for external links. The callback locates the target file name and object path
  within the lin…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: The HDF Group
product: HDF5
affected:
  - HDF5 < 2.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:52:43.758807Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:52:58.130Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120757'
references:
  - url: 'https://github.com/HDFGroup/hdf5/pull/6708'
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.04429
ingestedAt: '2026-11-05T20:33:06.331Z'
---

## Overview

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

## Affected

- `HDF5 < 2.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.