CVE-2026-120758

The record

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-121522 In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves… CWE-476
• CVE-2026-120955 The GridFS file download API in the MongoDB C Driver does not check the result of an… CWE-476
• CVE-2026-115297 NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to… CWE-476
• CVE-2026-43603 A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel… CWE-476
• CVE-2026-121402 FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows… CWE-476
• CVE-2026-121401 FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet… CWE-476
• CVE-2026-115403 In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket… CWE-476
• CVE-2026-114408 In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6… CWE-476