CVE-2026-120757

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen without validating the buffer against...