A pointer dereference flaw exists in the render_bin_output function of the h5dump tool in HDF5. When dumping a variable‑length string dataset containing more than one element in binary mode, the stride calculation is corrupted, causing subsequent elements to be read from a misaligned offset and dereferenced as a pointer. This leads to a crash of the h5dump process, effectively denying service to any operation that relies on the tool for data inspection or processing. The flaw does not directly expose data or allow arbitrary code execution, but it can interrupt critical workflows that depend on HDF5 datasets.

The vulnerability affects the HDF Group’s HDF5 package. All installations of h5dump in HDF5 versions prior to 2.1.1 are vulnerable. The issue is specific to the binary output mode of variable‑length string datasets; other modes and later releases are not impacted.

The lack of a publicly available CVSS score suggests the severity has not been formally quantified, but the impact is high because an adversary can cause a service disruption by submitting a crafted HDF5 file to h5dump. EPSS information is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed. The likely attack vector is file‑based: an attacker who can supply a malicious HDF5 file to h5dump, whether on a shared system or through a data ingestion pipeline, can trigger the crash. Remediation requires a patch, and no exploitation is possible without access to run the vulnerable tool against the malicious data.