CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL unprotect() in src/H5HL.c. H5HL protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL prfx dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC unpin entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.