The vulnerability CVE-2026-34734 affects HDFGroup's hdf5 software up to version 1.14.1-2. It is a heap use-after-free issue found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger this condition, where a previously freed object is accessed in a memmove call within the H5T__conv_struct function. The object is originally allocated by H5D__typeinfo_init_phase3 and freed by H5D__typeinfo_term. This vulnerability is classified under CWE-416 (Use After Free) and has a CVSS v3.1 score of 7.8, indicating high severity. There is no vendor advisory or patch currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could lead to memory corruption, potentially allowing an attacker to cause a crash or execute arbitrary code with the privileges of the user running the h5dump utility. The CVSS score indicates high impact on confidentiality, integrity, and availability. However, exploitation requires supplying a crafted h5 file and user interaction (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted or unauthenticated h5 files with the h5dump utility. Monitor official HDFGroup communications for updates or patches addressing this vulnerability.