Vulnerability · Published Nov 3, 2026 · Assigned by HDFG
CVE-2026-120755Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter
Medium 4.7
In plain English
A medium-severity out-of-bounds read in Szip Filter from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-120755 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-120755 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120755 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120755 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120755 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120755 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-120755 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | Szip Filter | < 2.3.0 |
Weakness: CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P