{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120689", "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "state": "PUBLISHED", "assignerShortName": "HDFG", "dateReserved": "2026-11-02T19:32:16.362Z", "datePublished": "2026-11-02T19:39:28.327Z", "dateUpdated": "2026-11-02T19:52:35.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74", "shortName": "HDFG", "dateUpdated": "2026-11-02T19:39:28.327Z"}, "title": "Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File", "affected": [{"vendor": "The HDF Group", "product": "HDF5", "modules": ["H5Gget_info"], "versions": [{"status": "affected", "version": "<2.3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node\u2019s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in <code>H5B__iterate_helper()</code> in <code>src/H5B.c</code>. When iterating a version 1 B-tree, the function does not verify that a child node\u2019s level matches the expected level. That check is performed only in <code>H5B__cache_deserialize()</code> when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling <code>H5Gget_info()</code> or <code>H5Gget_num_objs()</code> on a group in the crafted file, which reaches <code>H5B_iterate()</code> through <code>H5G__obj_info()</code> and <code>H5G__stab_count()</code>. An attacker who can get a user or application to open a malicious file can cause a denial of service.&nbsp;&nbsp;"}]}], "references": [{"url": "https://github.com/HDFGroup/hdf5/issues/6403"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}}], "credits": [{"lang": "en", "value": "Gabe Sherman", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "CWE-674 Uncontrolled Recursion"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:52:19.579381Z", "id": "CVE-2026-120689", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:52:35.578Z"}}]}}

{}

{}

{}

{}