Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120754— Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter

Quick assessment

Affected

The HDF Group Scale-Offset Filter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HDF5 2.2.0 及更早版本在文件的函数中存在未初始化内存读取漏洞。解码路径在验证读取操作时，使用的是块缓冲区的已分配大小，而非从文件中实际读取的字节数。由于函数会故意将经过过滤的块缓冲区大小设置为已存储块大小与未过滤块大小中的较大值，并且仅填充已存储的字节，因此被截断的块能够通过边界检查，并从分配内存中未初始化的剩余部分进行解压缩。随后，无关的堆内存内容会被作为数据集数据返回给调用者。由于所有读取操作均发生在已分配内存范围内，该问题无法被 AddressSanitizer 检测到。攻击者若能诱使用户或应

CVSS 1.9 · Low Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1569.002 · Service Execution T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
The HDF Group	Scale-Offset Filter	`< 2.3.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter

Source: CVE Program / CVE List V5

Vulnerability Description

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Source: CVE Program / CVE List V5

Vulnerability Type

对未经初始化资源的使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
The HDF Group	Scale-Offset Filter	< 2.3.0	-

II. Public POCs for CVE-2026-120754

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120754

请登录查看更多情报信息。

Other References for CVE-2026-120754 (1)

https://github.com/HDFGroup/hdf5/pull/6585

https://www.cve.org/CVERecord?id=CVE-2026-120754

Same Patch Batch · The HDF Group · 2026-11-03 · 5 CVEs total

CVE-2026-120757	6.9 MEDIUM	Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse
CVE-2026-120758	5.4 MEDIUM	NULL Pointer Dereference in H5HL_unprotect via Corrupted File
CVE-2026-120755	4.7 MEDIUM	Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter
CVE-2026-120756	1.9 LOW	Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize

IV. Related Vulnerabilities

Same vendor: The HDF Group

Same weakness: CWE-908