{"affected":[{"defaultStatus":"unaffected","product":"HDF5","source":"CNA: HDFG","vendor":"The HDF Group","versions":[{"status":"affected","version":"< 2.3.0"}]}],"cveId":"CVE-2026-120756","cwes":["CWE-125"],"description":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":1.9,"severity":"low","source":"CNA: HDFG","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"}],"modifiedAt":1793728520773,"publishedAt":1793719973768,"references":[{"source":"CNA: HDFG","tags":[],"url":"https://github.com/HDFGroup/hdf5/pull/6589"},{"source":"CNA: HDFG","tags":[],"url":"https://github.com/HDFGroup/hdf5/issues/6401"}],"remediation":[],"revision":"a98cea3526d1766d7677917e4861d965152be0020265836ad361e5613f7342be","sources":[{"modifiedAt":1793728520773,"name":"CNA: HDFG","retrievedAt":1793729368541,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120756"}],"ssvc":{"assessedAt":1793728508252,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize","updatedAt":1793729368541}