CVE-2026-120499
Description
A flaw was found in h5io. This vulnerability allows an attacker to execute arbitrary code by convincing a user to process a specially crafted Hierarchical Data Format (HDF5) file. During file parsing in the read_hdf5 function, unsafe evaluation and deserialization of embedded objects enables unauthorized code execution with the permissions of the application user.
Déclaration
Red Hat rates this vulnerability as Important severity because an attacker can achieve arbitrary execution within the process context without prior privileges, although exploitation requires local interaction to load malicious data. The affected library is not part of default system installations and is typically utilized within standalone data-processing environments rather than persistently exposed daemons. As a result, the risk is confined to individual workloads or user accounts that ingest datasets originating from unverified external sources.
Mesure d'atténuation
Do not load or process HDF5 files from untrusted or unverified external sources.
If processing untrusted datasets is required, execute workloads within an isolated container or restricted sandbox running under an unprivileged user account with minimal access to local storage and network resources.
Caveat: Sandboxing or container isolation mitigates lateral movement and host compromise but does not prevent malicious code execution within the isolated container boundary itself.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate dynamic eval and pickle deserialization when parsing HDF5 nodes in h5io: upgrade to h5io 0.2.6 (or the fixed Python H5Io builds), which replaces eval with an AST-based parser for timezone nodes and introduces allow_pickle=False by default to reject loading class, use_state, and pandas nodes, closing all 4 injection vectors (eval injection via timezone nodes, arbitrary module import via class nodes, pickle deserialization via pd_dataframe or pd_series nodes, unsafe object deserialization via use_state custom-object nodes). Until patched, this is a concern on Applications and user workloads processing untrusted HDF5 datasets with h5io.read_hdf5(), so Do not load or process HDF5 files from untrusted external sources, or execute processing workloads within an isolated sandbox running under an unprivileged account with minimal storage and network access. As a compensating measure, Deploy EDR agents to monitor and detect anomalous child processes, shell spawns, and post-exploitation activity from Python processes and Use Falco or eBPF runtime security sensors to detect unexpected process execution or anomalous network activity during HDF5 parsing. These controls limit blast radius and contain exploitation, but they do not fix the underlying unsafe evaluation and deserialization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)
Comprendre la Défaillance (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation
Technical Impact: Hide Activities
Often the actions performed by injected control code are unlogged.
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
