HDF5 EUVD-2026-116012

Requires a crafted HDF5 file containing an external link (H5L_TYPE_EXTERNAL) whose stored user data is either not NULL-terminated or too short to hold both the target file name and object path strings. The flaw lives in the default external-link traversal callback H5L__extern_traverse() and needs no special configuration - it is reachable in default operation. It triggers only when that specific malformed link is actually traversed, for example when the application opens an object through the link (H5Oopen/traversal). Limiting factors: attack vector is local (the crafted file must be delivered to and processed by the victim), and user/application interaction is required to open the file and traverse the link (UI:P); there is no remote network trigger and no authentication bypass. Affects HDF5 through 2.2.0.

This is a moderate, non-emergency issue, and the signals are internally consistent. The CVSS 4.0 vector (6.9) uses AV:L with UI:P, meaning there is no remote network trigger - a local user or application must open and traverse a crafted HDF5 file, matching the description. PR:N reflects that no authentication is needed once the file is processed, but the user-interaction requirement is the real brake on exploitation. The input provides no EPSS score, no CISA KEV listing, and no public exploit; the only reference is the upstream fix (HDFGroup PR #6708), not a PoC, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - routine prioritized patching, not act_now/emergency. Primary impact is denial of service via an unbounded heap over-read (VA:H); the confidentiality impact is limited and indirect (VC:L) - adjacent heap bytes may be pulled into the file name or object path the library then tries to open, which is not a direct read-back of memory to the attacker, so treat the information-disclosure angle as plausible leakage rather than reliable data exfiltration. Net: a real but low-urgency bug most relevant where HDF5 processes untrusted files.

An attacker supplies a crafted HDF5 file (e.g., a shared dataset, model file, or upload) containing an external link whose user data is not NULL-terminated or is too short to hold both the file name and object path strings. When a victim user or application opens an object through that link, H5L__extern_traverse() calls strlen() past the end of the udata heap buffer, crashing the application or incorporating adjacent heap contents into the path it attempts to open. No public exploit identified at time of analysis; the trigger path is confirmed by the upstream fix diff and its regression test.