Heap-based Buffer Over-read Vulnerability in HDF5 Library
CVE-2024-32620

7.4HIGH

Key Information:

Vendor

The HDF Group

Status
Hdf5
Vendor
CVE Published:
14 May 2024

What is CVE-2024-32620?

The HDF5 Library, up to version 1.14.3, is susceptible to a heap-based buffer over-read vulnerability within the function H5F_addr_decode_len located in H5Fint.c. This flaw can potentially lead to the corruption of the instruction pointer, posing a risk to the integrity and execution of the software. Remediation is available in version 1.14.4, where the issue has been addressed to enhance security and prevent exploitation.

References

https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixe...

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.