The vulnerability stems from the H5Z__nbit_decompress_one_* functions in H5Znbit.c, where a read index is incremented beyond the bounds of the compressed chunk buffer. This out‑of‑bounds heap read is a CWE‑125 flaw that can allow a crafted HDF5 file to expose memory adjacent to the buffer, potentially leaking sensitive data within the decompressed dataset values. The flaw is triggered when tools such as h5ls or h5repack invoke H5Dread to process a file containing an N‑Bit filter that specifies more decompressed data than the actual compressed chunk provides.

Affected versions are the official releases of HDF5 from the HDF Group up through version 2.3.0. The issue was discovered in the source file H5Znbit.c and applies to all builds that include the N‑Bit filter implementation in those releases.

With a CVSS score of 6.9, the vulnerability falls into the moderate severity band. No EPSS score is provided, and the flaw is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. However, an attacker who can supply a malicious HDF5 file to a system that performs H5Dread—such as a user running h5ls, h5repack, or a library that loads arbitrary files—could read beyond the intended buffer boundaries and potentially retrieve confidential heap content. The attack requires no privilege escalation but relies on the ability to process or import the crafted file.