{"id":"AZL-112640","summary":"CVE-2026-120758 affecting package hdf5 1.14.6-6","details":"HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap-\u003eprfx or heap-\u003edblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.","modified":"2026-11-04T14:17:26.297084647Z","published":"2026-11-03T16:17:23Z","upstream":["CVE-2026-120758"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120758"}],"affected":[{"package":{"name":"hdf5","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/hdf5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.6-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112640.json"}}],"schema_version":"1.9.2"}