The vulnerability CVE-2026-29043 affects HDFGroup's hdf5 software up to version 1.14.1-2. It is a heap-based buffer overflow triggered by an attacker-controlled h5 file during parsing in the H5T__ref_mem_setnull function. This overflow can cause a write beyond the allocated heap buffer, leading to denial-of-service and possibly remote code execution depending on the environment. The CVSS 3.1 base score is 5.5, reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

Successful exploitation can cause a denial-of-service condition by crashing the application processing the malicious h5 file. There is also a potential for remote code execution, but this depends on the practical exploitability of the heap overflow on the target system. The vulnerability does not impact confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted h5 files or apply any vendor-recommended workarounds once available.