High severity · published Mar 10, 2025
CVE-2025-2153
A vulnerability, which was classified as critical, was found in HDF5 1.14.6
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
Hdf5 · Hdfgroup
1.14.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2153
Exploit
https://github.com/HDFGroup/hdf5/issues/5329
Exploit
https://github.com/sae-as-me/Crashes/raw/refs/heads/main/hdf5/h5_extended_crash.h5
Permissions Required
https://vuldb.com/?ctiid.299064
Third Party Advisory
https://vuldb.com/?id.299064
Third Party Advisory
https://vuldb.com/?submit.510819
More from Hdf5
9.8
CVE-2024-32608
HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing denial of service or potential code execution
9.8
CVE-2024-33874
HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c
9.8
CVE-2024-32621
HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG_read in H5HG.c (called from H5VL__native_blob_get in H5VLnative_blob.c), resulting in the corruption of…
9.8
CVE-2024-32615
HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z__nbit_decompress_one_byte in H5Znbit.c, caused by the earlier use of an initialized pointer
9.8
CVE-2024-32611
HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c