PT-2025-11306 · Hdf5+1 · Hdf5+1

Zhang Yaoliang · Publicado 2025-03-14 · Atualizado 2026-01-16 · CVE-2025-2310

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.14.6

Description A critical issue affects the function H5MM strndup of the component Metadata Attribute Decoder, leading to heap-based buffer overflow. The manipulation requires local attacking. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Recommendations For HDF5 version 1.14.6, as a temporary workaround, consider disabling the H5MM strndup function until a patch is available.

Exploit

Correção

Buffer Overflow

Heap Based Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-119

CWE-122

CWE-787

Identificadores relacionados

AZL-58806

AZL-58825

CVE-2025-2310

ECHO-CCD1-8584-5447

OESA-2026-1131

OESA-2026-1132

OESA-2026-1133

OESA-2026-1134

OESA-2026-1135

RHSA-2025:23731

Produtos afetados

Debian

Hdf5

Referências · 51

• 🔥 https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md · Exploit
• https://github.com/HDFGroup/hdf5/pull/5872/changes · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1134 · Nota
• https://osv.dev/vulnerability/AZL-58825 · Aviso do Fabricante
• https://t.me/cvedetector/20344 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-6816 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-6857 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-6269 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-2310 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-2925 · Nota de Segurança
• https://t.me/cvetracker/19160 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-2310 · Nota de Segurança
• https://t.me/msrcreports/2727 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-6750 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-6818 · Nota de Segurança