Heap-based Buffer Overflow in HDF5 Affects Security of HDF Group Software
CVE-2025-6816

4.8MEDIUM

Key Information:

Vendor

HDF Group

Status
Hdf5
Vendor
CVE Published:
28 June 2025

Badges

👾 Exploit Exists

What is CVE-2025-6816?

A heap-based buffer overflow vulnerability exists in the HDF5 library version 1.14.6, specifically within the H5O__fsinfo_encode function in the src/H5Ofsinfo.c file. This flaw can be exploited locally, allowing attackers to manipulate memory in a way that can lead to software crashes or potentially arbitrary code execution. Public disclosure of this vulnerability raises concerns for users who must ensure that they implement appropriate security measures to protect their systems from this exploit.

Affected Version(s)

HDF5 1.14.6

References

https://vuldb.com/?id.314254
vdb-entrytechnical-description
https://vuldb.com/?ctiid.314254
signaturepermissions-required
https://vuldb.com/?submit.602291
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

JJLeo (VulDB User)
JSON
.