HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in
    src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file
    name and object path within the link’s user data using strlen() without validating the buffer against its
    stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose
    data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of
    the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun
    is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is
    traversed, for example when opening an object through it. An attacker who can get a user or application to
    access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into
    the external file name or object path the library attempts to open. (CVE-2026-120757)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in     src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file     name and object path within the link's user data using strlen() without validating the buffer against its     stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose     data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of     the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun     is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is     traversed, for example when opening an object through it. An attacker who can get a user or application to     access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into     the external file name or object path the library attempts to open. (CVE-2026-120757)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478408	Echo: hdf5: security update to 1.14.5+repack-3+e19	Tenable Cloud Security	Echo Local Security Checks	Local	medium
478408	Echo: hdf5: security update to 1.14.5+repack-3+e19	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
376178	Linux Distros Unpatched Vulnerability : CVE-2026-120757	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-120757

medium

Tenable Plugins

medium

medium

medium