A malformed HDF5 file can trigger a write‑based heap buffer overflow in the H5T__conv_struct_opt conversion routine. The flaw may cause a denial of service, and depending on the target operating system it could potentially enable remote code execution. The weakness is catalogued as a buffer overflow (CWE-122), erroneous buffer size handling (CWE-131), and an out‑of‑bounds write (CWE-787).

The vulnerability affects all installations of the HDFGroup HDF5 library older than version 1.14.4-2. Any system that processes untrusted HDF5 files with this library is at risk.

The CVSS score of 7.8 signals a high severity issue, while the EPSS score of less than 1 % indicates a very low probability of real‑world exploitation. The flaw is not catalogued in the CISA KEV list. An attacker must supply or force the processing of a malicious .h5 file, giving them local or remote access depending on how the library is used in the application. If the operating system can be manipulated via the overflow, remote code execution may be achieved; however, this remains speculative at present.