Application crash via point-selection size overflow

Heap buffer overflow in HDF5 Library 1.14.3 and earlier allows local users to crash an application via a malformed HDF5 point selection. H5S__point_deserialize multiplies untrusted element-count, rank, and encoded-width fields without checking overflow before using the wrapped size to validate and allocate the coordinate buffer. The attacker must cause a local application to parse the malformed selection; ensuing out-of-bounds coordinate writes can corrupt control flow and create a code-execution path.