# CVE-2026-120689: HDF5 uncontrolled recursion in B-tree iteration

Source: https://junglewise.ai/threats/cve-2026-120689-hdf5-through-2-2-0-contains-an-uncontrolled-recursion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120689 · Severity: info · Published 2026-11-02

HDF5 is a data management library used to store and retrieve large amounts of scientific data. A malicious HDF5 file can cause an application to crash with a stack overflow when calling certain group information functions, allowing an attacker to cause denial of service by distributing a crafted file.

Technologies: [Hdfgroup Hdf5](https://junglewise.ai/threats/technologies/hdf5). Vendors: [Hdfgroup](https://junglewise.ai/threats/vendors/hdfgroup).

## Quick answers

**Is CVE-2026-120689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120689 being exploited in the wild.

**How severe is CVE-2026-120689?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Hdfgroup Hdf5 through 2.2.0.

**Is there a fix for CVE-2026-120689?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120689 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-120689?** Check whether you run Hdfgroup Hdf5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The H5B__iterate_helper() function in src/H5B.c fails to validate that a child node's level matches the expected level when iterating version 1 B-trees. A crafted file with a B-tree child pointer that refers back to an already-cached node (including self-referential pointers) bypasses the level check performed during cache deserialization, causing unbounded recursion and stack exhaustion. The vulnerability is triggered when applications call H5Gget_info() or H5Gget_num_objs() on a group.

## Affected products

- HDFGroup HDF5 through 2.2.0

## Timeline

- 2026-05-12: disclosed
- 2026-10-08: other: Fixed in PR #6685
- 2026-11-02: advisory

## References

- [https://github.com/HDFGroup/hdf5/issues/6403](https://github.com/HDFGroup/hdf5/issues/6403)

## Related threats

- [HDF5 NULL pointer dereference in H5HL_unprotect](https://junglewise.ai/threats/cve-2026-120758-hdf5-through-2-2-0-contains-a-null-pointer-dereference)
- [HDF5 heap buffer over-read in object header deserialization](https://junglewise.ai/threats/cve-2026-120756-hdf5-through-2-2-0-contains-a-heap-buffer-over-read)
- [HDF5 out-of-bounds read in szip filter](https://junglewise.ai/threats/cve-2026-120755-hdf5-through-2-2-0-contains-an-out-of-bounds-read-vulnerability)
- [HDFGroup HDF5 heap buffer overflow in H5T__ref_mem_setnull](https://junglewise.ai/threats/cve-2026-29043-hdfgroup-hdf5-heap-buffer-overflow-in-h5t-ref-mem-setnull)
- [HDFGroup HDF5 heap use-after-free in h5dump utility](https://junglewise.ai/threats/cve-2026-34734-hdfgroup-hdf5-heap-use-after-free-in-h5dump-utility)