Heap-Based Buffer Overflow in HDF5 Affects HDF Group's Software
CVE-2025-2912
4.8MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-2912?
A vulnerability exists in HDF5 versions up to 1.14.6 where the H5O_msg_flush function in src/H5Omessage.c can be exploited to cause a heap-based buffer overflow. This specific vulnerability arises from improper handling of the argument 'oh'. A local attacker could manipulate this flaw to execute arbitrary code, leading to potential system compromise. The exploit details have been made public, increasing the risk for affected installations.
Affected Version(s)
HDF5 1.14.0
HDF5 1.14.1
HDF5 1.14.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.