Description
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Published: 2026-11-03
Score: 1.9 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/HDFGroup/hdf5/pull/6585 cve-icon cve-icon
History

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Hdfgroup
Hdfgroup hdf5
CPEs cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*
Vendors & Products Hdfgroup
Hdfgroup hdf5
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Tue, 03 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 1.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}

 cvssV4_0

{'score': 1.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Tue, 03 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
Description HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Title Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter
Weaknesses CWE-908
References
Metrics cvssV4_0

{'score': 1.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}

Subscriptions

Hdfgroup Hdf5
cve-icon MITRE

Status: PUBLISHED

Assigner: HDFG

Published:

Updated: 2026-11-03T17:58:54.979Z

Reserved: 2026-11-02T21:30:10.354Z

Link: CVE-2026-120754

cve-icon Vulnrichment

Updated: 2026-11-03T17:58:40.999Z

cve-icon NVD

Status : Analyzed

Published: 2026-11-03T16:17:22.627

Modified: 2026-11-03T21:10:24.930

Link: CVE-2026-120754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T16:45:14Z

Weaknesses