CVE-2026-120754

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

• CWE-908

• https://github.com/HDFGroup/hdf5/pull/6585Issue Tracking, Patch

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120716Insertion of sensitive information into sent data in the ide…
• CVE-2026-12073The ProfileGrid – User Profiles, Groups and Communities plug…9.8
• CVE-2026-120733Cleartext storage of sensitive information in the user accou…
• CVE-2026-120734Cleartext transmission of sensitive information in the email…
• CVE-2026-120740A flaw was found in hivex. By supplying a specially crafted …2
• CVE-2026-120752PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer over…7.5
• CVE-2026-120755HDF5 through 2.2.0 contains an out-of-bounds read vulnerabil…5.5
• CVE-2026-120756HDF5 through 2.2.0 contains a heap buffer over-read vulnerab…6.1
• CVE-2026-120757HDF5 through 2.2.0 contains a heap buffer over-read vulnerab…7.1
• CVE-2026-120758HDF5 through 2.2.0 contains a NULL pointer dereference vulne…5.5
• CVE-2026-12076Raytha CMS is vulnerable to SQL Injection within the OData f…9.3
• CVE-2026-12077The Dokan Pro plugin for WordPress is vulnerable to time-bas…7.5