The vulnerability exists in the H5Z__filter_fletcher32 function within H5Zfletcher32.c of the HDF5 library versions up to 2.3.0. The function calculates the data length to checksum by subtracting 4 bytes (the size of the trailing checksum) from the input buffer size without checking if the buffer is at least 4 bytes long. This can cause a size_t underflow, leading to a massively out-of-bounds read in the H5_checksum_fletcher32 function. An attacker can trigger this by providing a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, causing denial of service through application crashes during operations like H5Dread, which are used by tools such as h5ls or h5dump.

Successful exploitation results in denial of service due to application crashes caused by out-of-bounds memory reads. There is no indication of privilege escalation, code execution, or data corruption beyond the crash. The impact is limited to local or adjacent access vector with user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed HDF5 files, especially those with Fletcher32-filtered chunks smaller than 4 bytes. Monitor for updates from The HDF Group regarding an official fix.