The vulnerability in HDF5 occurs due to inconsistent metadata in array datatypes where the full size, element count, and element size fields do not match (element size * number of elements ≠ full size). This inconsistency can lead to an out-of-bounds read (CWE-125) when processing such corrupted files. The flaw is only exploitable if an attacker can supply or alter HDF5 files to have these corrupted values. The vulnerability has a CVSS 4.0 base score of 5.9, indicating medium severity, with network attack vector, high attack complexity, and requires user interaction and partial attack complexity. There is no known exploit in the wild and no vendor patch or fix has been documented at this time.

An attacker who can supply a maliciously crafted HDF5 file with inconsistent array datatype metadata can trigger an out-of-bounds read in the hdf5 library. This may lead to information disclosure or application instability depending on how the out-of-bounds read is handled. The vulnerability does not affect normal files and requires crafted input. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted or potentially maliciously altered HDF5 files. No official remediation or temporary fix has been provided by the vendor at this time.