The vulnerability arises in the H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions within H5Znbit.c of HDF5 versions up to 2.3.0. These functions improperly advance the read index into the compressed chunk buffer without verifying bounds, leading to an out-of-bounds heap read. An attacker can craft an HDF5 file with N-Bit filter parameters that specify more decompressed data than the compressed chunk contains, causing adjacent heap memory to be disclosed in decompressed dataset values. The flaw is triggered during dataset reads (e.g., via H5Dread) and affects tools like h5ls and h5repack that rely on these functions.

Successful exploitation can lead to disclosure of adjacent heap memory contents, potentially leaking sensitive information. The vulnerability requires local access (attack vector: local) and user interaction but does not allow privilege escalation or code execution. The CVSS 4.0 base score is 6.9 (medium severity), reflecting limited impact and exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should avoid processing untrusted or crafted HDF5 files with affected versions until a patch or mitigation is available.