CyberRota Analysis
AI-GeneratedThe vulnerability affects the HDF5 library, specifically the H5Z__nbit_decompress functions, which improperly advance a read index without checking the buffer size. This flaw can lead to out-of-bounds heap reads, potentially disclosing adjacent heap memory when processing specially crafted HDF5 files. Organizations using affected versions of HDF5, particularly those employing tools like h5ls or h5repack, should prioritize patching to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools.