The hdf5 library contains a heap-buffer-overflow vulnerability triggered in the H5MM_xstrdup function, which is involved in duplicating strings. The overflow occurs during a read operation of 5 bytes, causing a crash in the call stack involving H5G__ent_to_link and H5G__stab_lookup_cb functions. This vulnerability was identified through OSS-Fuzz and affects several explicit versions of hdf5, including 1.14.1, 2.0.0, 2.1.0-pre1test, 2.1.0, 2.1.1, 2.2.0-rc1, and 2.2.0. There is no information about a patch or vendor advisory, and no known exploits have been reported.

The vulnerability results in a heap-buffer-overflow read, which can cause application crashes when processing certain data. While no known exploits are reported, such memory corruption issues may potentially be leveraged for denial of service or other impacts depending on context. The exact impact beyond crashing is not detailed in the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official hdf5 channels for updates. Until a fix is available, cautious handling of inputs processed by the affected functions is advised.