A pointer dereference flaw exists in the render_bin_output function of the h5dump tool in HDF5 before 2.3.0. When dumping a variable‑length string dataset with more than one element in binary mode, the stride calculation is corrupted, causing subsequent elements to be read from a misaligned offset and dereferenced as a pointer. This fault leads to a crash of the h5dump process, effectively denying service to any operation that relies on the tool for data inspection or processing. The flaw does not expose data or allow arbitrary code execution, but it can disrupt critical workflows that depend on HDF5 datasets.

The vulnerability affects the HDF Group’s HDF5 package. All installations of h5dump in HDF5 versions prior to 2.3.0 are vulnerable. The issue is specific to the binary output mode of variable‑length string datasets; other modes and later releases are not impacted.

The CVSS score of 6.8 indicates a moderate severity, suggesting the impact is high because an adversary can cause a service disruption by submitting a crafted HDF5 file to h5dump. EPSS remains under 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed. The likely attack vector is file‑based: an attacker who can supply a malicious HDF5 file to h5dump, whether on a shared system or through a data ingestion pipeline, can trigger the crash. Remediation requires a patch, and no exploitation is possible without access to run the vulnerable tool against the malicious data.