{"id":"AZL-112634","summary":"CVE-2026-120756 affecting package hdf5 1.14.6-6","details":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.","modified":"2026-11-04T14:17:37.572153219Z","published":"2026-11-03T16:17:22Z","upstream":["CVE-2026-120756"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120756"}],"affected":[{"package":{"name":"hdf5","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/hdf5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.6-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112634.json"}}],"schema_version":"1.9.2"}