Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/HDFGroup/hdf5/pull/6589 Diğer
• github.com/HDFGroup/hdf5/issues/6401 Diğer

Kayıt geçmişi

1. 3 Kas 2026 18:32Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted File
• 6,9 CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
• 4,3 CVE-2026-120689Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
• 3,7 CVE-2026-121626GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler
• 3,7 CVE-2026-121625GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing
• 3,3 CVE-2026-121604wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c