h5io read_hdf5 flaw allows arbitrary code execution

Python data library: a rigged file lets attackers take over your PC.

Summary

h5io is a Python library for reading data files; a crafted file can make read_hdf5 run arbitrary code. Versions before 0.2.6 are affected, along with programs built on it such as MNE-Python.

Affected when

Opening untrusted HDF5 files with h5io

What to do

Update to h5io 0.2.6. Until then, do not call read_hdf5 on files from untrusted sources.

Products and platforms

h5io

CVE IDs

CVE-2026-120499 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 16:55 UTC

First seen 2026-11-09 17:00 UTC