A double free vulnerability exists in the HDF5 library’s H5D__chunk_copy() function, triggered when processing a crafted HDF5 file that contains an oversized chunk-index size field. The flaw causes the application, such as h5repack, to abort abruptly due to a double free of memory, potentially leading to a crash and denial of service. The CVE specifically describes an abort rather than arbitrary code execution, implying the primary impact is loss of availability.

The vulnerability affects the HDF Group's HDF5 library, versions not explicitly listed in the advisory. Systems that install any unpatched iteration of HDF5 and that use h5repack or similar utilities that parse custom HDF5 files are at risk. The impact extends to any process that loads or repacks these files, regardless of whether the file originates locally.

The CVSS score of four indicates a moderate severity, while the EPSS score of 0.00117 indicates a very low exploitation probability, and the CVE is not listed in the CISA KEV catalog. The likely attack vector is local or file-based penetration: an adversary would need to supply a malicious HDF5 file to the target application or otherwise influence the file processed by h5repack. The requirement for privilege or local access suggests a lower probability of widespread exploitation, but the vulnerability can be leveraged by anyone who controls a file that the application processes.