{"id":"DEBIAN-CVE-2026-120756","details":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.","modified":"2026-11-04T15:00:06.806950437Z","published":"2026-11-03T16:17:22.940Z","upstream":["CVE-2026-120756"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-120756"}],"affected":[{"package":{"name":"hdf5","ecosystem":"Debian:12","purl":"pkg:deb/debian/hdf5?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.10+repack-1","1.10.10+repack-2","1.10.10+repack-3","1.10.10+repack-3.1","1.10.10+repack-3.2","1.10.10+repack-3.2+ports","1.10.10+repack-3.3","1.10.10+repack-4","1.10.10+repack-5","1.10.8+repack1-1","1.12.0+repack-1~exp1","1.12.0+repack-1~exp2","1.12.2+repack-1~exp1","1.14.3+repack-1~exp1","1.14.3+repack1-1~exp2","1.14.3+repack1-1~exp3","1.14.4.3+repack-1~exp1","1.14.4.3+repack-1~exp2","1.14.4.3+repack-1~exp3","1.14.5+repack-1","1.14.5+repack-1~exp1","1.14.5+repack-1~exp2","1.14.5+repack-1~exp3","1.14.5+repack-1~exp4","1.14.5+repack-1~exp5","1.14.5+repack-1~exp6","1.14.5+repack-2","1.14.5+repack-3","1.14.5+repack-3.1","1.14.5+repack-3~exp1","1.14.5+repack-3~exp2","1.14.5+repack-3~exp3","1.14.5+repack-3~exp4","1.14.5+repack-4","1.14.5+repack-4~exp1","1.14.5+repack-4~exp2","1.14.5+repack-5~exp2","1.14.5+repack-5~exp3","1.14.6+repack-1","1.14.6+repack-1~exp1","1.14.6+repack-1~exp10","1.14.6+repack-1~exp11","1.14.6+repack-1~exp12","1.14.6+repack-1~exp13","1.14.6+repack-1~exp14","1.14.6+repack-1~exp15","1.14.6+repack-1~exp16","1.14.6+repack-1~exp17","1.14.6+repack-1~exp18","1.14.6+repack-1~exp19","1.14.6+repack-1~exp2","1.14.6+repack-1~exp20","1.14.6+repack-1~exp21","1.14.6+repack-1~exp3","1.14.6+repack-1~exp4","1.14.6+repack-1~exp5","1.14.6+repack-1~exp6","1.14.6+repack-1~exp7","1.14.6+repack-1~exp8","1.14.6+repack-1~exp9","1.14.6+repack-2","1.14.6+repack-3~exp1","2.1.0+repack-1","2.1.0+repack-1~exp10","2.1.0+repack-1~exp11","2.1.0+repack-1~exp3","2.1.0+repack-1~exp4","2.1.0+repack-1~exp5","2.1.0+repack-1~exp6","2.1.0+repack-1~exp7","2.1.0+repack-1~exp8","2.1.0+repack-1~exp9","2.2.0+repack-1","2.2.0+repack-2","2.2.0+repack-3","2.2.0+repack-4","2.2.0+repack-5","2.2.0+repack-6"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120756.json"}},{"package":{"name":"hdf5","ecosystem":"Debian:13","purl":"pkg:deb/debian/hdf5?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.5+repack-3","1.14.5+repack-3.1","1.14.5+repack-4","1.14.5+repack-4~exp1","1.14.5+repack-4~exp2","1.14.5+repack-5~exp2","1.14.5+repack-5~exp3","1.14.6+repack-1","1.14.6+repack-1~exp1","1.14.6+repack-1~exp10","1.14.6+repack-1~exp11","1.14.6+repack-1~exp12","1.14.6+repack-1~exp13","1.14.6+repack-1~exp14","1.14.6+repack-1~exp15","1.14.6+repack-1~exp16","1.14.6+repack-1~exp17","1.14.6+repack-1~exp18","1.14.6+repack-1~exp19","1.14.6+repack-1~exp2","1.14.6+repack-1~exp20","1.14.6+repack-1~exp21","1.14.6+repack-1~exp3","1.14.6+repack-1~exp4","1.14.6+repack-1~exp5","1.14.6+repack-1~exp6","1.14.6+repack-1~exp7","1.14.6+repack-1~exp8","1.14.6+repack-1~exp9","1.14.6+repack-2","1.14.6+repack-3~exp1","2.1.0+repack-1","2.1.0+repack-1~exp10","2.1.0+repack-1~exp11","2.1.0+repack-1~exp3","2.1.0+repack-1~exp4","2.1.0+repack-1~exp5","2.1.0+repack-1~exp6","2.1.0+repack-1~exp7","2.1.0+repack-1~exp8","2.1.0+repack-1~exp9","2.2.0+repack-1","2.2.0+repack-2","2.2.0+repack-3","2.2.0+repack-4","2.2.0+repack-5","2.2.0+repack-6"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120756.json"}},{"package":{"name":"hdf5","ecosystem":"Debian:14","purl":"pkg:deb/debian/hdf5?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.5+repack-3","1.14.5+repack-3.1","1.14.5+repack-4","1.14.5+repack-4~exp1","1.14.5+repack-4~exp2","1.14.5+repack-5~exp2","1.14.5+repack-5~exp3","1.14.6+repack-1","1.14.6+repack-1~exp1","1.14.6+repack-1~exp10","1.14.6+repack-1~exp11","1.14.6+repack-1~exp12","1.14.6+repack-1~exp13","1.14.6+repack-1~exp14","1.14.6+repack-1~exp15","1.14.6+repack-1~exp16","1.14.6+repack-1~exp17","1.14.6+repack-1~exp18","1.14.6+repack-1~exp19","1.14.6+repack-1~exp2","1.14.6+repack-1~exp20","1.14.6+repack-1~exp21","1.14.6+repack-1~exp3","1.14.6+repack-1~exp4","1.14.6+repack-1~exp5","1.14.6+repack-1~exp6","1.14.6+repack-1~exp7","1.14.6+repack-1~exp8","1.14.6+repack-1~exp9","1.14.6+repack-2","1.14.6+repack-3~exp1","2.1.0+repack-1","2.1.0+repack-1~exp10","2.1.0+repack-1~exp11","2.1.0+repack-1~exp3","2.1.0+repack-1~exp4","2.1.0+repack-1~exp5","2.1.0+repack-1~exp6","2.1.0+repack-1~exp7","2.1.0+repack-1~exp8","2.1.0+repack-1~exp9","2.2.0+repack-1","2.2.0+repack-2","2.2.0+repack-3","2.2.0+repack-4","2.2.0+repack-5","2.2.0+repack-6"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120756.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}]}