Vulnerability · Published Nov 3, 2026 · Assigned by HDFG
CVE-2026-120754Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter
Low 1.9
In plain English
A low-severity security flaw in Scale-Offset Filter from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-120754 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-120754 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120754 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120754 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120754 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120754 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-120754 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | Scale-Offset Filter | < 2.3.0 |
Weakness: CWE-908 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P