CVE-2025-2912 MEDIUM

CVE-2025-2912: HDF5 H5Omessage.c H5O_msg_flush heap-based overflow

Vendor N/A
Product HDF5
Weakness CWE-122
Published March 28, 2025
Last update July 24, 2025

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in HDF5 up to 1.14.6. It has been declared as problematic. Affected by this vulnerability is the function H5O_msg_flush of the file src/H5Omessage.c. The manipulation of the argument oh leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 28, 2025 CVE published
July 24, 2025 Record updated