CVE-2026-120755
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
34/100
Published: 2026-11-03
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
Present
VC:
None
VI:
None
VA:
High
Description
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| The HDF Group | Szip Filter | < 2.3.0 |
| The HDF Group | Szip Filter | < 2.3.0 |
| hdfgroup | hdf5 | < 2.2.0 |