Null Terminator Underflow in HDF5 Library Affects HDF5 Data Model Implementation

CVE-2026-26199

What is CVE-2026-26199?

The HDF5 Library, a widely-used framework for managing and storing data, is susceptible to a null terminator underflow vulnerability. This issue arises when the function H5Iget_name is called with an invalid group ID and a zero size parameter, leading to an underflow condition while attempting to place a null terminator in the designated buffer. If exploited, it may compromise the integrity of critical data preceding the affected name buffer. Users of HDF5 should review security advisories and apply recommended patches to safeguard against this potential risk.

References