A NULL pointer dereference in the H5Pget_fill_value routine of the HDF5 library allows an attacker to crash the application that loads an HDF5 file. The vulnerability is triggered when a dataset contains a malformed fill value message where the “defined” flag is set but the size field is negative. The library fails to normalize this value to its sentinel for undefined data, causing a dereference of a NULL datatype during path resolution. The immediate impact is a denial of service, potentially leading to loss of application availability for any process that attempts to open such a file.

The vulnerability affects installations of the HDF Group HDF5 library prior to version 2.3.0. Any system, service, or application that uses an older HDF5 binary and processes user‑supplied or untrusted HDF5 files is at risk. This includes scientific computing environments, data ingestion pipelines, and any software that parses HDF5 datasets from external sources.

The CVSS score of 8.2 classifies this flaw as high severity. The EPSS score of 0.00126 (less than 1%) indicates a very low probability of exploitation, although the high CVSS suggests severe impact if exploited. The absence of a listing in the CISA KEV catalog implies no known widespread exploitation. The attack vector is likely local or remote through a crafted HDF5 file that an application must load. An attacker can trigger the crash simply by ensuring that the problematic fill value message is parsed, which does not require elevated privileges if the application reads the file. Consequently, the risk remains significant for any system that processes external HDF5 data.