The vulnerability exists in the function H5Z__filter_nbit within H5Znbit.c in HDF5 versions up to 2.3.0. The function dereferences elements cd_values[0] through cd_values[4] without checking if the pointer cd_values is NULL or if the number of elements cd_nelmts is at least 5, which is required for the filter's header. An attacker can exploit this by crafting an HDF5 file that stores the N-Bit filter pipeline message with zero client-data values and then opening and reading it via H5Dread, causing a NULL pointer dereference and denial of service.

Successful exploitation results in denial of service by crashing the application processing the malicious HDF5 file. There is no indication of privilege escalation, data corruption, or information disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted HDF5 files that may contain crafted N-Bit filter pipeline messages with zero client-data values.