The vulnerability lies in the function that initializes the fill-value buffer when read data chunks that are not yet allocated. A crafted HDF5 file can provide metadata that mismatches the allocated buffer size, causing a heap-based overflow. An attacker can control the overwrite through the fill value stored in the file, potentially leading to a crash or execution of arbitrary code.

Affected systems are installations of the HDF5 library from The HDF Group, versions earlier than 2.2.0. The issue originates in the core H5VM.c component. The vulnerability is present in all builds of HDF5 before the 2.2.0 release.

The CVSS score of 8.5 indicates a high severity. EPSS scores 0.00163 (< 1%) indicate a low probability of exploitation, which combined with the absence from KEV suggests no known widespread exploitation. Because the flaw only manifests when a malicious HDF5 file is processed, the attack vector is file ingestion. The lack of a public workaround and the potential for remote code execution denote a significant risk for systems that import HDF5 files from untrusted sources.