Hdf5 · Hdf5 · CVE-2025-2153
**Name of the Vulnerable Software and Affected Versions**
HDF5 version 1.14.6
**Description**
A critical issue was found in the `H5SM delete` function of the `h5 File Handler` component, located in the `H5SM.c` file. This issue leads to a heap-based buffer overflow. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been publicly disclosed.
**Recommendations**
For HDF5 version 1.14.6, as a temporary workaround, consider disabling the `H5SM delete` function until a patch is available. Restrict access to the `h5 File Handler` component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.