3.3

CVE-2026-120754: Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter

Analyzed
Published 03-11-2026Last modified 03-11-2026

Vulnerability summary

CVE-2026-120754 is a low (CVSS 3.3) Use of Uninitialized Resource vulnerability in hdfgroup hdf5.

Priority
Routine

Not severe (CVSS 1.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.3/10
010
Low · v3.1 (NVD)
EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 03-11-2026
    PublishedVulnerability first disclosed.
  2. 03-11-2026
    Last modifiedVulnerability information updated.

Description

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Hdfgroup1 product
The hdf group1 product

2 vendors · 2 products

References

1 links