HDF5 EUVD-2026-116017

Requires the attacker to craft a malicious HDF5 file with a corrupted local heap and get a user or application to open AND traverse it (UI:P - passive interaction, merely processing the file). The crash specifically requires the metadata cache to destroy the corrupted local heap entry (unlinking heap->prfx or heap->dblk), which the vendor's own test provokes by using a metadata cache small enough that entries are evicted during traversal; the fix PR also forces the data block into its own cache entry via heap growth. Limiting factors: exploitation is local only (no network vector), depends entirely on file delivery and victim action, requires no authentication or privileges, and the impact ceiling is a process crash - no code execution, data disclosure, or integrity loss. Debug builds hit an assertion failure; release builds suffer the NULL pointer dereference and crash.

This is a genuine but low-urgency issue - a NULL pointer dereference (CWE-476) leading only to a denial of service. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) is internally consistent with the description: exploitation is local, requires a user to passively open and traverse a crafted file, needs no privileges, and impacts only availability (VA:H) with no confidentiality or integrity effect. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with a crash-only bug. No EPSS score and no CISA KEV entry are provided, so there is no signal of active or widespread exploitation; absence of these is expected for a newly-disclosed library DoS. The CVSS exploit-maturity flag E:P (proof-of-concept) is corroborated by the fix PR, which ships a reproduction file (heap_corrupt_prfx.h5) and a regression test that deliberately triggers the crash. Bottom line: a real, confirmed defect worth patching on a normal cadence, but not an emergency - impact ceilings at application crash, and exploitation depends on convincing a victim to open a malicious file.

An attacker crafts a malformed HDF5 file whose local heap is corrupted and distributes it (e.g., as a dataset, model file, or scientific data artifact). When a victim user or application opens and traverses the file - and the metadata cache evicts/destroys the corrupted local heap entry - H5HL_unprotect() is reached with no cached object to unpin and passes a NULL pointer to H5AC_unpin_entry(), crashing the process. A public PoC reference exists in the form of the fix PR's regression test, though it is not packaged as a standalone weaponized exploit.