PT-2025-13548 · Hdf5+1 · Hdf5+1

Chen Lihai · Published 2025-03-28 · Updated 2026-03-29 · CVE-2025-2912

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HDF5 versions up to 1.14.6

Description A heap-based buffer overflow issue has been identified, affecting the H5O msg flush function in the file src/H5Omessage.c. The manipulation of the oh argument leads to this issue. The attack requires local access.

Recommendations For HDF5 versions up to 1.14.6, consider restricting access to the H5O msg flush function until a patch is available. As a temporary workaround, avoid using the oh argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-122

CWE-787

Related Identifiers

CVE-2025-2912

ECHO-DFC4-87E9-66A2

OESA-2026-1131

OESA-2026-1132

OESA-2026-1133

OESA-2026-1134

OESA-2026-1135

Affected Products

Debian

Hdf5

References · 46

• 🔥 https://github.com/HDFGroup/hdf5/issues/5370 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6816 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6857 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6269 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2310 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-2912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6818 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7067 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2153 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1132 · Vendor Advisory