HDF5 versions through 2.2.0 contain a heap buffer over-read vulnerability in the function H5O__chunk_deserialize() within src/H5Ocache.c. This flaw occurs when decoding object header messages, where the declared message size check does not fully account for certain header fields, allowing a crafted file to cause reads beyond allocated heap memory. Exploitation requires opening a malicious HDF5 file, potentially leading to denial of service or limited disclosure of process memory.