The vulnerability CVE-2026-34734 in HDFGroup's hdf5 software is a heap use-after-free issue found in the h5dump helper utility in versions up to 1.14.1-2. An attacker supplying a malicious h5 file can cause the program to reference a freed heap object during a memmove call in the H5T__conv_struct function. The affected memory was originally allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term, leading to unsafe memory access. This vulnerability has a CVSS 3.1 score of 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, but requiring user interaction. The impact includes potential full compromise of confidentiality, integrity, and availability of the affected system. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary code execution or program crash due to use-after-free, impacting confidentiality, integrity, and availability of the system running hdf5. The attack requires local access and user interaction, limiting remote exploitation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malicious h5 files with the h5dump utility. Monitor official HDFGroup communications for updates or patches addressing this vulnerability.