CVE-2025-2924 MEDIUM

CVE-2025-2924: HDF5 H5HLcache.c H5HL__fl_deserialize heap-based overflow

Vendor N/A
Product HDF5
Weakness CWE-122
Published March 28, 2025
Last update July 24, 2025

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache.c. The manipulation of the argument free_block leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 28, 2025 CVE published
July 24, 2025 Record updated