The HDF5 library contains a reachable assertion vulnerability (CWE-617) leading to a NULL pointer dereference (CWE-476). When an application processes a specially crafted HDF5 file that includes an attribute with an invalid variable-length datatype type field, it may cause the application to crash upon reading this attribute. The CVSS 4.0 base score is 5.2 (medium severity), with attack vector local, low complexity, no privileges required, user interaction required, and high impact on availability. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation results in an application crash due to NULL pointer dereference when reading a malformed attribute in an HDF5 file. This impacts availability but does not indicate confidentiality or integrity loss. The attack requires local access and user interaction, limiting remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed HDF5 files containing variable-length datatype attributes. Monitor vendor communications for updates on patches or mitigations.