PT-2025-11306 · Hdf5+1 · Hdf5+1

Zhang Yaoliang · Published 2025-03-14 · Updated 2026-01-16 · CVE-2025-2310

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HDF5 version 1.14.6

Description A critical issue affects the function H5MM strndup of the component Metadata Attribute Decoder, leading to heap-based buffer overflow. The manipulation requires local attacking. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Recommendations For HDF5 version 1.14.6, as a temporary workaround, consider disabling the H5MM strndup function until a patch is available.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-122

CWE-787

Related Identifiers

AZL-58806

AZL-58825

CVE-2025-2310

ECHO-CCD1-8584-5447

OESA-2026-1131

OESA-2026-1132

OESA-2026-1133

OESA-2026-1134

OESA-2026-1135

RHSA-2025:23731

Affected Products

Debian

Hdf5

References · 51

• 🔥 https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md · Exploit
• https://osv.dev/vulnerability/AZL-58825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6816 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6857 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6269 · Security Note
• https://ubuntu.com/security/CVE-2025-2310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6818 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2310 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-58806 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7067 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-2310 · Vendor Advisory