The vulnerability in HDF5 arises from improper handling of the size parameter in the H5Iget_name function. When invoked with size set to zero, the function attempts to write a null terminator before the start of the buffer, causing a buffer underwrite (CWE-124). This can corrupt memory adjacent to the buffer if critical data is located there. The CVSS 4.0 base score is 5.9 (medium), indicating a network attack vector with high impact on availability but requiring high attack complexity and user interaction. No official remediation or patch information is currently available.

Exploitation of this vulnerability can cause memory corruption due to buffer underwrite, potentially leading to application crashes or denial of service. The CVSS vector indicates no confidentiality or integrity impact, but a high impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid invoking H5Iget_name with a size parameter of zero or ensure input validation prevents zero size values.