Description
HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.
Published: 2026-11-03
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Update HDF5
AI Analysis

Impact

An integer underflow in H5Z__filter_szip() can cause an out-of-bounds read when a compressed chunk is shorter than the 4‑byte length header. The decoder calculates a large read size that exceeds the buffer, allowing an attacker to trigger a denial of service by supplying a crafted HDF5 file that a user or application processes. The vulnerability is a classic out-of-bounds read (CWE‑125).

Affected Systems

Affected vendors include The HDF Group for its Szip Filter component. Any HDF5 build that includes the szip library (libaec or the legacy szip library) before version 2.2.1 is susceptible. The CVE lists builds up to 2.2.0; version details for newer releases are not specified.

Risk and Exploitability

With a CVSS score of 4.7 the vulnerability falls in the medium range and the EPSS score is currently unavailable, implying that no active exploitation data is known. The issue is not listed in the CISA KEV catalog. Because the exploit requires a crafted file that an application reads, the most likely vector is local or opportunistic, inferred from the description. Consequently, the risk is limited to environments that ingest untrusted HDF5 files without validation.

Generated by OpenCVE AI on November 3, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched HDF5 release (2.2.1 or later) that corrects the integer underflow in the szip filter.
  • If an upgrade is not immediately possible, avoid using the szip filter or remove szip support from the build.
  • Implement file integrity checks—validate the chunk size against the known header before decompression—to prevent out-of-bounds reads in the absence of a patch.

Generated by OpenCVE AI on November 3, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/HDFGroup/hdf5/pull/6585 cve-icon cve-icon
History

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Hdfgroup
Hdfgroup hdf5
CPEs cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*
Vendors & Products Hdfgroup
Hdfgroup hdf5
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Tue, 03 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Description HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.
Title Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 4.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hdfgroup Hdf5
cve-icon MITRE

Status: PUBLISHED

Assigner: HDFG

Published:

Updated: 2026-11-03T15:43:43.838Z

Reserved: 2026-11-02T21:30:10.652Z

Link: CVE-2026-120755

cve-icon Vulnrichment

Updated: 2026-11-03T15:43:33.553Z

cve-icon NVD

Status : Analyzed

Published: 2026-11-03T16:17:22.790

Modified: 2026-11-03T21:10:08.367

Link: CVE-2026-120755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T16:45:14Z

Weaknesses