# CVE-2026-120758: HDF5 NULL pointer dereference in H5HL_unprotect

Source: https://junglewise.ai/threats/cve-2026-120758-hdf5-through-2-2-0-contains-a-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-120758 · Severity: info · Published 2026-11-03

HDF5 is a data management library used to store and organize large amounts of scientific data. A maliciously crafted HDF5 file can cause applications using the library to crash when opening or reading the file, disrupting workflows and potentially causing data loss in automated systems. An attacker can achieve this denial of service by providing a corrupted file that triggers a NULL pointer dereference.

Technologies: [Hdfgroup Hdf5](https://junglewise.ai/threats/technologies/hdf5). Vendors: [Hdfgroup](https://junglewise.ai/threats/vendors/hdfgroup).

## Quick answers

**Is CVE-2026-120758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120758 being exploited in the wild.

**How severe is CVE-2026-120758?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Hdfgroup Hdf5 through 2.2.0.

**Is there a fix for CVE-2026-120758?** A patch was published on 2026-10-03: Fix merged in PR #6377 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120758 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-120758?** Check whether you run Hdfgroup Hdf5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in H5HL_unprotect() in src/H5HL.c when processing corrupted HDF5 files. When the metadata cache evicts a corrupted local heap entry, the heap->prfx or heap->dblk pointers are set to NULL; subsequent calls to H5HL_unprotect() dereference these NULL pointers when calling H5AC_unpin_entry(), causing a segmentation fault in release builds and assertion failures in debug builds. The vulnerability is triggered by opening and traversing a malicious HDF5 file without requiring authentication or special privileges.

## Affected products

- HDFGroup HDF5 through 2.2.0

## Timeline

- 2026-11-03: disclosed
- 2026-10-03: patched: Fix merged in PR #6377

## References

- [https://github.com/HDFGroup/hdf5/pull/6377](https://github.com/HDFGroup/hdf5/pull/6377)

## Related threats

- [HDF5 heap buffer over-read in object header deserialization](https://junglewise.ai/threats/cve-2026-120756-hdf5-through-2-2-0-contains-a-heap-buffer-over-read)
- [HDF5 out-of-bounds read in szip filter](https://junglewise.ai/threats/cve-2026-120755-hdf5-through-2-2-0-contains-an-out-of-bounds-read-vulnerability)
- [HDF5 uncontrolled recursion in B-tree iteration](https://junglewise.ai/threats/cve-2026-120689-hdf5-through-2-2-0-contains-an-uncontrolled-recursion)
- [HDFGroup HDF5 heap buffer overflow in H5T__ref_mem_setnull](https://junglewise.ai/threats/cve-2026-29043-hdfgroup-hdf5-heap-buffer-overflow-in-h5t-ref-mem-setnull)
- [HDFGroup HDF5 heap use-after-free in h5dump utility](https://junglewise.ai/threats/cve-2026-34734-hdfgroup-hdf5-heap-use-after-free-in-h5dump-utility)