Which versions of HDF5 are affected by CVE-2025-6269?

Organizations using HDF5 should be aware of moderate risk from CVE-2025-6269, a buffer overflow vulnerability rated CVSS 5.3. Exploitation could cause memory corruption or application crashes.. A patch is available.

Is there a public PoC exploit available for CVE-2025-6269?

Yes, a public proof-of-concept exploit is available for CVE-2025-6269. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6269?

Within 30 days: Identify affected systems running HDF5 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

HDF5 CVE-2025-6269

Q: What is the CVSS score of CVE-2025-6269?

CVE-2025-6269 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18690 LOW

Buffer Overflow (CWE-119)

2025-06-19 cna@vuldb.com

Buffer Overflow Hdf5

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local attack vector, low complexity, low privileges required.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Ubuntu

MEDIUM

qualitative

SUSE

4.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 1.9 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18690

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jul 02, 2025 - 19:01 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 16:15 nvd

MEDIUM 5.3

CVE Published

Jun 19, 2025 - 16:15 cve.org

LOW 1.9

DescriptionCVE.org

A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

AnalysisAI

Heap-based buffer overflow in HDF5 up to 1.14.6 allows local attackers to execute arbitrary code or cause denial of service via a crafted file. Public exploit code exists, but no active exploitation in the wild has been confirmed. EPSS score is low (0.05%), indicating low exploitation probability.

Technical ContextAI

The vulnerability resides in the H5C__reconstruct_cache_entry function within H5Cimage.c, part of HDF5's metadata cache subsystem. HDF5 is a widely used library for storing and managing large scientific data. The issue is a classic heap-based buffer overflow (CWE-119), where improper bounds checking allows writing beyond allocated heap memory. CPE data confirms all HDF5 versions up to 1.14.6 are affected.

RemediationAI

Upgrade to the latest patched version of HDF5 (1.14.7 or later) as provided by the vendor. Red Hat has released RHSA-2025:23731 for affected Red Hat products. As a workaround, avoid opening untrusted HDF5 files from untrusted sources. No other compensating controls are recommended due to the local nature of the attack.