The vulnerability is a buffer underflow that occurs when H5Iget_name is called with a size value of zero. The function writes a null terminator into the buffer without verifying its length, and the underflow can overwrite adjacent memory. This can happen during the execution of H5G_get_name, which in turn invokes H5Iget_name on a group ID. Based on the description, it is inferred that the vulnerability can be triggered when the size parameter is forced to zero, allowing the underflow. The consequence is memory corruption that can cause an application crash, data corruption, or, if an attacker can influence the write location, potential arbitrary code execution. The weakness is identified as CWE‑124.

The issue is present in the HDFGroup HDF5 library, a high‑performance data management framework used in scientific computing and other domains. No specific patch level is identified in the advisory, so any deployment of the library that might invoke H5Iget_name or H5G_get_name with a user‑supplied size argument could be affected. Organizations should verify that all recent HDF5 releases include the fix or, lacking a patch, implement defensive checks during development.

The CVSS score of 5.9 places the vulnerability in the medium severity range. The EPSS score indicates a very low exploitation probability, with a value of <1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is influencing the size parameter passed to H5Iget_name or H5G_get_name, so the attack is more likely in contexts where the library is called with application‑level arguments that can be controlled by a user or a malicious file. If the function is reached in a setting where the caller does not supply a safe buffer size, the underflow can be triggered. The lack of a publicly documented exploit means current risk is limited to crashes or memory corruption, but the potential for exploitation in more complex attacks should not be ignored.