H5Z__filter_nbit in H5Znbit.c of HDF5 may dereference the cd_values array without validating that it is non‑null or large enough to contain five elements. This flaw can be triggered by a crafted HDF5 file that uses the N‑Bit filter pipeline message with zero client‑data values. When an untrusted file is read, for example by the h5ls or h5repack utilities, the program will dereference a null or short array, causing a crash and a denial of service. The weakness is a null pointer dereference and an array bounds violation (CWE‑1284, CWE‑476). The impact is limited to a crash of the process that processes the file; no information disclosure or code execution is possible.

The HDF Group’s HDF5 library, versions through 2.3.0, is affected. Any installation that uses HDF5 to read or process external HDF5 files, including the command‑line tools h5ls and h5repack, is potentially vulnerable.

The CVSS score of 6.8 indicates medium severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious HDF5 file that the target system reads; a typical vector is a data ingestion workflow or local user tricking the system into opening a crafted file. Because the flaw is a trigger in a file‑reading routine, it is exploitable only when the application accepts untrusted files, but a successful exploit will simply crash the HDF5 process leading to denial of service.