CVE and update status of the FreeBSD ports tree3,610 unaddressed CVEs in 712 portsAll times are CET
CVE details

CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.

Score
5.4 medium
Published
2026-11-03
Links
NVD · cve.org · Report wrong data

Matched ports (4)

PortPackageVersionStatusMaintainer
science/hdf5hdf51.12.2_2,1unaddressedsunpoet@FreeBSD.org
science/hdf5-110hdf5-1101.10.11unaddressedsunpoet@FreeBSD.org
science/hdf5-18hdf5-181.8.23unaddressedthierry@FreeBSD.org
science/hdf5-21hdf5-212.1.1unaddressedwen@FreeBSD.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Not finished: this entry still needs a checked upper bound for every package. Do not commit it as it is.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

No CPE in the port Makefile

science/hdf5 (CPE taken from Repology) has no USES=cpe. The CVE was matched through a CPE from another source, so the package and the version range may belong to a different product. Check the CVE record before using this entry.

  <vuln vid="FIXME (make newentry)">
    <topic>hdf5 -- FIXME</topic>
    <affects>
      <package>
	<name>hdf5</name>
	<!-- 2.3.0 is not released yet, newest upstream is 2.2.0 -->
	<range><lt>2.3.0,1</lt></range>
      </package>
      <package>
	<name>hdf5-110</name>
	<name>hdf5-18</name>
	<name>hdf5-21</name>
	<!-- no fixed release for the 1.10 line in the CVE record (fixed in 2.3.0) -->
	<!-- no fixed release for the 1.8 line in the CVE record (fixed in 2.3.0) -->
	<!-- no fixed release for the 2.1 line in the CVE record (fixed in 2.3.0) -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-120758: HDF5 through 2.2.0 contains a NULL pointer
	  dereference vulnerability in H5HL_unprotect() in src/H5HL.c.
	  H5HL_protect() pins a single metadata cache entry for a local heap,
	  either the heap prefix or the separate data block, and
	  H5HL_unprotect() unpins it on the final unprotect. When the
	  metadata cache destroys a corrupted local heap entry,
	  H5HL__prfx_dest() unlinks it from the heap by setting heap-&gt;prfx or
	  heap-&gt;dblk to NULL. A crafted HDF5 file can therefore reach
	  H5HL_unprotect() with no cached object to unpin, and the function
	  passes the NULL pointer to H5AC_unpin_entry(). This causes an
	  assertion failure in debug builds and a NULL pointer dereference
	  and crash in release builds. An attacker who can get a user or
	  application to open and traverse a malicious file can cause a
	  denial of service.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-120758</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-120758</url>
    </references>
    <dates>
      <discovery>2026-11-03</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>