CVE-2026-120757: HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal

Q: How do I fix CVE-2026-120757?

hdf5: upgrade to newer than 2.2.0. Exact commands for each OS are on this page.

Q: Is CVE-2026-120757 being exploited?

CVE-2026-120757 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-120757 affect?

CVE-2026-120757 affects hdf5. Severity is high (CVSS 7.1). HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s

Routine

HIGH 7.1UPGRADE

CVE-2026-120757 is a high-severity flaw (CVSS 7.1) affecting hdf5. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is to

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.1 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	n/a
CISA exploited list	No
Weakness	CWE-125
Published	2026-11-03
Last modified	2026-11-03

Publisher (CNA): HDFG · Vendor: hdfgroup

Last updated 2026-11-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-11-03 16:17 UTCPublished CVE record published
2026-11-03 21:09 UTCUpdated Record last modified

hdfgroup hdf5 UPGRADE

Affected: <= 2.2.0

Fixed in: newer than 2.2.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy hdf5 || rpm -q hdf5 || hdf5 --version

2. UPGRADE to newer than 2.2.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade hdf5

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade hdf5

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Advisories and coverage

Research and news

VulDB Recent Entries: CVE-2026-120757 | HDF Group HDF5 up to 2.2.x External Link Traversal src/H5Lexternal.c H5L__extern_traverse heap-based overflow 2026-11-03
Vulners Bulletins: CVE-2026-120757 Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse 2026-11-03
Vulners Bulletins: CVE-2026-120757 Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse 2026-11-03

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-120757?

hdf5: upgrade to newer than 2.2.0. Exact commands for each OS are on this page.

Is CVE-2026-120757 being exploited?

CVE-2026-120757 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-120757 affect?

CVE-2026-120757 affects hdf5. Severity is high (CVSS 7.1). HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s

How urgent is CVE-2026-120757?

Priority 25/100. High severity

Related CVEs

CVE-2026-120754 LOW 3.3 UPGRADE HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Z
CVE-2026-120755 MEDIUM 5.5 UPGRADE HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c
CVE-2026-120756 MEDIUM 6.1 UPGRADE HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.
CVE-2026-120758 MEDIUM 5.5 UPGRADE HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c
CVE-2026-34734 HIGH 7.8 UPGRADE HDF5 is software for managing data

References

← Back to latest CVEs