CVE-2026-120758
Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in HDF5 Library

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: HDFG

Description
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120758
EUVD
EUVD-2026-116017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The HDF Group HDF5 < 2.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the HDF5 library through version 2.2.0. It occurs in the H5HL_unprotect() function when processing corrupted HDF5 files. The function attempts to unpin a metadata cache entry that no longer exists, leading to a crash in release builds or an assertion failure in debug builds. An attacker can exploit this by tricking a user into opening a malicious file, causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking for crashes or errors when processing HDF5 files. Use fuzz testing tools like AFL or OSS-Fuzz to generate and test malicious HDF5 files. Monitor system logs for segmentation faults or assertion failures during HDF5 file operations.

Impact Analysis

If you use applications that rely on HDF5 to open or process HDF5 files, this vulnerability could cause the application to crash when opening a specially crafted malicious file. This may lead to data loss or disruption of services that depend on HDF5 functionality.

Mitigation Strategies

Update HDF5 to the latest patched version from the HDF Group. If updating is not possible, avoid opening untrusted HDF5 files. Implement input validation for HDF5 files in applications. Apply the security patch from pull request #6377 if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...