CVE-2026-34734

HDF5 versions 1.14.1-2 and earlier contain a heap-use-after-free vulnerability in the h5dump utility that occurs when processing malicious HDF5 files. The vulnerability arises from a freed object being incorrectly referenced in a memmove call within the H5T__conv_struct function, after the object was deallocated by H5D__typeinfo_term. Any user processing untrusted HDF5 files through h5dump is potentially at risk. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector requiring only user interaction to trigger. The attack has low complexity, as an attacker needs only to supply a malicious HDF5 file, and impacts all three security properties: confidentiality, integrity, and availability. This indicates the flaw could lead to information disclosure, data corruption, or service disruption. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, and no active exploitation has been reported. The EPSS score of 0.00013 indicates minimal observed exploitation in the wild relative to other vulnerabilities. Community attention remains limited, suggesting this is a lower-priority remediation item compared to more widely exploited flaws, though patching remains advisable for organizations regularly handling HDF5 data files.