CVE-2026-120757

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

• CWE-125

• https://github.com/HDFGroup/hdf5/pull/6708Issue Tracking, Patch

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120734Cleartext transmission of sensitive information in the email…
• CVE-2026-120740A flaw was found in hivex. By supplying a specially crafted …2
• CVE-2026-120752PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer over…7.5
• CVE-2026-120754HDF5 through 2.2.0 contains an uninitialized memory read vul…3.3
• CVE-2026-120755HDF5 through 2.2.0 contains an out-of-bounds read vulnerabil…5.5
• CVE-2026-120756HDF5 through 2.2.0 contains a heap buffer over-read vulnerab…6.1
• CVE-2026-120758HDF5 through 2.2.0 contains a NULL pointer dereference vulne…5.5
• CVE-2026-12076Raytha CMS is vulnerable to SQL Injection within the OData f…9.3
• CVE-2026-12077The Dokan Pro plugin for WordPress is vulnerable to time-bas…7.5
• CVE-2026-120775Tanium addressed a heap-based buffer overflow vulnerability …7.2
• CVE-2026-12079The Dokan Pro plugin for WordPress is vulnerable to time-bas…6.5
• CVE-2026-1208The Friendly Functions for Welcart plugin for WordPress is v…4.3