CVE-2026-120757: 
NixOS vulnerability analysis and mitigation

CVE-2026-120757 is a heap buffer over-read vulnerability in The HDF Group's HDF5 library, specifically in the H5L__extern_traverse() function in src/H5Lexternal.c, the default traversal callback for external links. It affects HDF5 versions through 2.2.0 (all versions prior to 2.3.0). The flaw was disclosed on November 3, 2026, with a fix merged into the HDF5 develop branch on October 8, 2026. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in H5L__extern_traverse(), which uses strlen() to locate the target file name and object path within an external link's user data buffer (udata) without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose udata is not NULL-terminated, or is too short to hold both the file name and object path strings, causes strlen() to read past the end of the heap-allocated udata buffer; the overrun is unbounded and continues until a null byte is found in adjacent heap memory. The derived object path pointer may also point outside the buffer. The vulnerability is triggered when the malicious external link is traversed — for example, when an application opens an object through it — requiring only that a user or application be induced to open a crafted HDF5 file (Github Advisory, HDF5 PR #6708).

Successful exploitation can cause a denial of service by crashing the application that processes the malicious HDF5 file. Additionally, adjacent heap contents may be read and incorporated into the external file name or object path that the library subsequently attempts to open, creating a risk of partial memory disclosure (confidentiality impact). There is no integrity impact, and the vulnerability is scoped to the vulnerable system without lateral propagation to subsequent systems (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, as it requires user interaction (a victim must open a crafted file). No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local, requiring the attacker to deliver a malicious HDF5 file to a target user or application.

1. Craft a malicious HDF5 file: Create an HDF5 file containing an external link with a malformed udata payload — for example, a 3-byte buffer (0x00 'a' 'a') written via H5Lcreate_ud() that is not NULL-terminated or is too short to contain both the file name and object path strings.
2. Deliver the file: Distribute the crafted HDF5 file to a target user or application that processes HDF5 files (e.g., via email attachment, shared storage, or a data pipeline that ingests user-supplied HDF5 data).
3. Trigger link traversal: Induce the victim application to open an object through the malicious external link, causing H5L__extern_traverse() to be invoked.
4. Heap over-read occurs: strlen() reads past the end of the udata heap buffer, scanning adjacent heap memory until a null byte is found. The derived object path pointer may also point outside the buffer.
5. Achieve objective: The application crashes (denial of service), and adjacent heap contents may be incorporated into the file name or path the library attempts to open, potentially leaking sensitive heap data (HDF5 PR #6708, Github Advisory).

• File System: Presence of unexpected or externally sourced .h5 or .hdf5 files containing external links with unusually short or malformed udata payloads.
• Process: Application crashes or abnormal termination of processes that use the HDF5 library when opening HDF5 files; AddressSanitizer (ASan) reports of heap-buffer-overflow READ at strlen in H5L__extern_traverse on a buffer allocated in H5O__link_copy.
• Logs: Application error logs showing crashes or exceptions during HDF5 external link traversal; core dump files generated by HDF5-consuming processes.

Upgrade HDF5 to version 2.3.0 or later, which includes the fix that validates the udata buffer against udata_size before parsing, rejecting buffers that are too small, not NULL-terminated, or missing the object path (HDF5 PR #6708). Until patching is possible, restrict application access to untrusted or externally sourced HDF5 files, and disable external link traversal in the application if the HDF5 API supports this option (e.g., via link access property lists). Red Hat has tracked this issue and may provide downstream patches for affected packages (Red Hat Bugzilla).

Red Hat's Product Security team opened a tracking bug (Bug 2565946) and classified the issue as medium severity, with multiple engineers assigned to assess downstream impact on Red Hat products (Red Hat Bugzilla). RedPacketSecurity noted the vulnerability on Mastodon shortly after disclosure. No significant broader media coverage or notable independent researcher commentary has been identified beyond standard vulnerability database aggregation.