Malicious model file: H5Ocont_min.h5 (4,639 bytes, SHA-256 fe08dbd36c1d6103444acdfba94ed38c5f455c3e5ace1c31bb72e3ee3439b33f)

Opening this crafted HDF5 (.h5) file triggers a 1-byte heap out-of-bounds read in H5O__cont_decode() (the object-header continuation-message decoder) at src/H5Ocont.c:105 (H5F_DECODE_LENGTH) during H5Fopen() — i.e. on file open, before any dataset is read.

Reached by any consumer that opens the file: keras.models.load_model(), h5py.File(), h5dump. Reproduces on libhdf5 2.0.0 and develop HEAD 58b87ef (2026-06-03); distinct from the patched 2025 continuation-message CVEs (PR #5710, #5829 / CVE-2025-6816/6856/2923, #5850 / CVE-2025-6269).

ASAN reports: READ of size 1 ... 0 bytes after a 47-byte region, stack H5O__cont_decode <- H5O__chunk_deserialize <- H5O_protect <- H5F_open <- H5Fopen.

This repository hosts the proof-of-concept artifact for a huntr Model File Format disclosure.