The hdf5 library contains a heap-buffer-overflow vulnerability in the H5F_addr_encode function, identified through OSS-Fuzz testing. The crash occurs during a write operation that exceeds the allocated heap buffer, involving the call stack functions H5F_addr_encode, H5O__fsinfo_encode, and H5O_msg_flush. The vulnerability affects several explicit versions of hdf5, including 1.14.1, 2.0.0, 2.1.0-pre1test, 2.1.0, 2.1.1, 2.2.0-rc1, and 2.2.0. There is no CVSS score or detailed vendor advisory available, and no known exploits in the wild have been reported.

Heap-buffer-overflow vulnerabilities can lead to memory corruption, which may cause application crashes or potentially enable arbitrary code execution depending on the context. However, no specific impact details or exploitation reports are provided. The affected versions are explicitly listed, but the absence of a patch or fix status means the vulnerability may remain unmitigated in those versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the affected versions or applying any available workarounds from the vendor. Monitoring the official hdf5 project and OSS-Fuzz reports for updates is recommended.