4.8 Medium

CVE-2025-2310 A vulnerability was found in HDF5 1.14.6 and classified as critical

Description

A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Affected products and versions

Product	Affected versions	Fixed in
HDF5	1.14.6	No fix stated

References

VDB-299723 | HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow vuldb.com
VDB-299723 | CTI Indicators (IOB, IOC, IOA) vuldb.com
Submit #514533 | HDFGroup hdf5 v1.14.6 Buffer Overflow vuldb.com
github.com github.com

Timeline

Published March 14, 2025
Last modified May 8, 2025

The 25 CVEs of HDF5 →

CVE-2025-7069 A vulnerability, which was classified as problematic, was found in HDF5 1.14.6 4.8 Medium CVE-2025-7068 A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6 4.8 Medium CVE-2025-7067 A vulnerability classified as problematic was found in HDF5 1.14.6 4.8 Medium CVE-2025-6858 A vulnerability was found in HDF5 1.14.6 and classified as problematic 4.8 Medium

Track this CVE

CVE-2025-2310 A vulnerability was found in HDF5 1.14.6 and classified as critical

Description

Affected products and versions

References

Timeline

Other CVEs of HDF5