PT-2025-13549 · Hdf5+1 · Hdf5+1

Chen Lihai · Published 2025-03-28 · Updated 2026-03-29 · CVE-2025-2913

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HDF5 versions up to 1.14.6

Description A issue was found in the function H5FL blk gc list of the file src/H5FL.c. The manipulation of the argument H5FL blk head t leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Recommendations For HDF5 versions up to 1.14.6, as a temporary workaround, consider disabling the function H5FL blk gc list until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Use After Free

Weakness Enumeration

CWE-119

CWE-416

Related Identifiers

CVE-2025-2913

ECHO-4043-7553-2164

OESA-2026-1131

OESA-2026-1132

OESA-2026-1133

OESA-2026-1134

OESA-2026-1135

Affected Products

Debian

Hdf5

References · 47

• 🔥 https://github.com/HDFGroup/hdf5/issues/5376 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-2913 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6816 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6857 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6269 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6818 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-2913 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-2913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7067 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2153 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2913 · Vendor Advisory