NULL Pointer Dereference in H5HL_unprotect via Corrupted File

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/HDFGroup/hdf5/pull/6377 Diğer

Kayıt geçmişi

1. 3 Kas 2026 18:38Yayımlandı

İlgili açıklar

• 6,9 CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
• 1,9 CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize
• 4,3 CVE-2026-120689Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
• 6,9 CVE-2026-43603A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of s…
• 6,5 CVE-2026-121402FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
• 4,3 CVE-2026-121401FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet