Heap-Based Buffer Overflow in HDF5 Affects HDF Group's Software
CVE-2025-2912

4.8MEDIUM

Key Information:

Vendor

HDF Group

Status
Vendor
CVE Published:
28 March 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-2912?

A vulnerability exists in HDF5 versions up to 1.14.6 where the H5O_msg_flush function in src/H5Omessage.c can be exploited to cause a heap-based buffer overflow. This specific vulnerability arises from improper handling of the argument 'oh'. A local attacker could manipulate this flaw to execute arbitrary code, leading to potential system compromise. The exploit details have been made public, increasing the risk for affected installations.

Affected Version(s)

HDF5 1.14.0

HDF5 1.14.1

HDF5 1.14.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

References

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.