HDF5: Heap buffer over-read in H5L__extern_traverse (CVE-2026-120757)

HDF5 through version 2.2.0 contains a heap buffer over-read vulnerability in the H5L__extern_traverse() function within src/H5Lexternal.c. The flaw stems from the use of strlen() to process link user data without validating the buffer size or checking for NULL termination. An attacker can supply a specially crafted HDF5 file containing an external link that, when traversed, triggers an unbounded read of memory beyond the heap buffer. This behavior can lead to application crashes (denial of service) or allow sensitive data in adjacent heap memory to be leaked into the file path or object path buffers.

Impact

An attacker can induce a denial of service by crashing the application. Additionally, there is a risk of information disclosure where adjacent heap contents are incorporated into the external file name or object path, which the library subsequently attempts to open.

Recommendation

• Audit applications utilizing HDF5 libraries to identify versions 2.2.0 or older.
• Prioritize upgrading to a patched release of HDF5 as soon as it becomes available from The HDF Group.
• Implement file integrity and validation checks for HDF5 files ingested from untrusted or external sources to prevent the processing of malicious link structures.