Answer in brief
CVE-2026-120754 records a Low severity (CVSS 1.9) vulnerability in Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter. The current sources do not mark it as known exploited. The current feed maps The HDF Group/Scale-Offset Filter (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 1.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps The HDF Group/Scale-Offset Filter (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| The HDF Group/Scale-Offset Filtergeneric | <2.3.0 | 2.3.0 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.
Quoted source text, attributed separately from HOL analysis.