Vulnerability · Published Nov 3, 2026 · Assigned by HDFG
CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted File
Medium 5.4
In plain English
A medium-severity null pointer dereference in HDF5 from The HDF Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hdf5 | no fix listed | DEBIAN-CVE-2026-120758 |
| Debian:13 | hdf5 | no fix listed | DEBIAN-CVE-2026-120758 |
| Debian:14 | hdf5 | no fix listed | DEBIAN-CVE-2026-120758 |
| Ubuntu:22.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120758 |
| Ubuntu:24.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120758 |
| Ubuntu:26.04:LTS | hdf5 | no fix listed | UBUNTU-CVE-2026-120758 |
| Ubuntu:26.10 | hdf5 | no fix listed | UBUNTU-CVE-2026-120758 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The HDF Group | HDF5 | < 2.3.0 |
Weakness: CWE-476 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P