PT-2025-10590 · Hdf5+1 · Hdf5+1
Chen Lihai
+1
·
Published
2025-03-10
·
Updated
2026-03-29
·
CVE-2025-2153
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HDF5 version 1.14.6
Description
A critical issue was found in the
H5SM delete function of the h5 File Handler component, located in the H5SM.c file. This issue leads to a heap-based buffer overflow. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been publicly disclosed.Recommendations
For HDF5 version 1.14.6, as a temporary workaround, consider disabling the
H5SM delete function until a patch is available. Restrict access to the h5 File Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Hdf5