A heap‑based buffer overflow occurs in the SOHM list‑index deserialization code of the HDF5 library when it processes a crafted HDF5 file whose shared‑message list index declares a num_messages count that exceeds the internal list_max value. The out‑of‑bounds heap reads and writes that happen inside the H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum functions cause the library to crash, resulting in a denial of service for any application that loads the file.

The vulnerability affects the HDF Group’s HDF5 library on all platforms for versions up to and including 2.1.1. Any application that loads HDF5 files without validating the file format or imposing restrictions on untrusted input is susceptible.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by supplying a malicious HDF5 file with a malformed num_messages field to any component that invokes the affected deserialization path; no arbitrary code execution is possible, but the resulting crash can disrupt services or enable repeated denial-of-service if the application restarts automatically.