HDF5, versions 1.14.1-2 and earlier, have a heap buffer overflow in the H5T__ref_mem_setnull function. A crafted HDF5 file can trigger this overflow when processed, causing a denial‑of‑service condition and potentially allowing an attacker to execute code depending on how the overflow is exploited on the target operating system. The weakness originates from writing beyond a heap allocation while setting reference memory to null.

All installations of the HDFGroup HDF5 library running version 1.14.1‑2 or earlier are vulnerable. This includes any application that parses or loads user‑supplied HDF5 files, such as scientific computing, data analytics, and other data‑processing workloads that rely on HDF5.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply the vulnerable program with a malicious HDF5 file; successful exploitation could result in denial of service or, under certain conditions, remote code execution. No official workaround is documented, so patching is the recommended defense.