CVE-2026-34734 is a heap use-after-free vulnerability in the h5dump helper utility of HDFGroup's hdf5 software. The issue affects versions 1.14.1-2 and earlier. The vulnerability arises because an object allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term is still referenced in a memmove call from H5T__conv_struct when processing a malicious h5 file. This can lead to memory corruption and potentially allow an attacker with local access to cause a denial of service or execute arbitrary code. The CVSS 3.1 base score is 7.8, indicating high severity with impact on confidentiality, integrity, and availability. No official patch or remediation level is provided in the vendor advisory, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to memory corruption due to use-after-free, potentially resulting in denial of service or arbitrary code execution. The CVSS vector indicates local attack vector with low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the vendor advisory, users should monitor the Red Hat advisory page for updates. Until a patch is available, avoid processing untrusted or malicious h5 files with the h5dump utility to reduce risk.