Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/HDFGroup/hdf5/pull/6585 Diğer

Kayıt geçmişi

1. 3 Kas 2026 18:27Yayımlandı

İlgili açıklar

• 3,7 CVE-2026-121626GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler
• 3,7 CVE-2026-121625GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing
• 3,3 CVE-2026-121604wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c
• 6,9 CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
• 6,3 CVE-2026-65138NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to…
• 1,9 CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize