The vulnerability is a divide‑by‑zero error triggered when a chunked dataset in an HDF5 file is opened and read but the stored chunk-layout dimensionality does not match the dataspace rank. This mismatch causes a SIGFPE in the library’s hyper‑iteration code, resulting in an application crash that manifests as a denial‑of‑service condition. The weakness is classified as CWE‑369, a division‑by‑zero flaw.

The vulnerability affects the HDF Group’s HDF5 library through version 2.3.0, including all products that rely on these library releases for opening or reading HDF5 datasets.

The CVSS score of 6.8 indicates moderate severity, but the lack of an EPSS score and absence from the KEV catalog suggest limited or no recorded exploit activity. The likely attack vector involves an application that opens a maliciously crafted HDF5 file, such as the h5repack utility; the exploit requires local file access or the ability to trick a legitimate application into reading the file.