PT-2025-28020 · Hdf5+1 · Hdf5+1

Jjleo · Published 2025-06-06 · Updated 2026-03-29 · CVE-2025-7067

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: HDF5 version 1.14.6

Description: A problematic vulnerability was found in HDF5, affecting the function H5FS sinfo serialize node cb of the file src/H5FScache.c. This vulnerability leads to a heap-based buffer overflow. Local access is required to exploit this issue. The exploit has been disclosed to the public.

Recommendations: For HDF5 version 1.14.6, consider disabling the H5FS sinfo serialize node cb function as a temporary workaround until a patch is available. Restrict local access to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

AZL-65157

AZL-65208

BDU:2026-03170

CVE-2025-7067

ECHO-8347-7D53-6029

OESA-2026-1131

OESA-2026-1132

OESA-2026-1133

OESA-2026-1134

OESA-2026-1135

Affected Products

Debian

Hdf5

References · 54

• 🔥 https://github.com/HDFGroup/hdf5/issues/5577 · Exploit
• 🔥❌ https://github.com/user-attachments/files/20623499/hdf5_crash_9.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-2924 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6750 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-7067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2926 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7067 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-7067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6516 · Security Note
• https://bdu.fstec.ru/vul/2026-03170 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6857 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory