The vulnerability (CVE-2026-19025) occurs in the H5O__layout_decode function of HDF5 (up to version 2.3.0). It fails to validate that the dimensionality of a chunked dataset's stored chunk layout matches the dataspace rank when opening an existing dataset. This check is only performed at dataset creation, not at open time. An attacker can exploit this by crafting an HDF5 file with mismatched chunk and dataspace ranks, triggering a divide-by-zero error and crashing the application in the H5S__hyper_iter_get_seq_list function during H5Dopen2 and H5Dread calls, such as when using the h5repack tool.

This vulnerability allows an attacker to cause a denial of service by crashing applications that open and read maliciously crafted HDF5 files. There is no indication of code execution or data corruption beyond the crash. The CVSS 4.0 score is 6.8 (medium severity), reflecting local attack vector with low complexity and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening or processing untrusted HDF5 files, especially with tools like h5repack. Monitor vendor channels for updates and apply official patches once released.