Heap-Based Buffer Overflow in HDF5 1.14.6 Affects HDFGroup
CVE-2025-2308

4.8MEDIUM

Key Information:

Vendor

HDFGroup

Status
Hdf5
Vendor
CVE Published:
14 March 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-2308?

A vulnerability exists within the HDF5 1.14.6 implementation that affects the Scale-Offset Filter function, H5Z__scaleoffset_decompress_one_byte. This issue can lead to a heap-based buffer overflow, which poses risk if exploited locally. Despite the public disclosure of the exploit, the viability of the vulnerability remains uncertain as the vendor has not provided a detailed response regarding its existence or severity. The lack of communication raises concerns over the handling of this vulnerability by HDFGroup, prompting the community to remain cautious and vigilant.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HDF5 1.14.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-2308 - Proof of Concept

References

https://vuldb.com/?id.299721
vdb-entrytechnical-description
https://vuldb.com/?ctiid.299721
signaturepermissions-required
https://vuldb.com/?submit.514531
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhang Yaoliang (VulDB User)
JSON
.