Vulnerability · Published Nov 2, 2026 · Assigned by HDFG
CVE-2026-120689Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
Medium 4.3
In plain English
A medium-severity security flaw in HDF5 from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-120689 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-120689 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120689 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120689 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120689 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120689 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-120689 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | HDF5 | <2.3.0 |
Weakness: CWE-674 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U