Which versions of HDF5 are affected by CVE-2025-6270?

Organizations using HDF5 should be aware of moderate risk from CVE-2025-6270, a buffer overflow vulnerability rated CVSS 5.3. Exploitation could cause memory corruption or application crashes.. A patch is available.

Is there a public PoC exploit available for CVE-2025-6270?

Yes, a public proof-of-concept exploit is available for CVE-2025-6270. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6270?

Within 30 days: Identify affected systems running HDF5 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

HDF5 CVE-2025-6270

Q: What is the CVSS score of CVE-2025-6270?

CVE-2025-6270 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18688 LOW

Buffer Overflow (CWE-119)

2025-06-19 cna@vuldb.com

Buffer Overflow Hdf5

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local attack vector, low privileges required, low complexity, low impact on confidentiality, integrity, and availability.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Ubuntu

MEDIUM

qualitative

SUSE

4.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 1.9 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18688

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jan 23, 2026 - 20:49 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 17:15 nvd

MEDIUM 5.3

CVE Published

Jun 19, 2025 - 17:15 cve.org

LOW 1.9

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

AnalysisAI

Heap-based buffer overflow in HDF5 up to 1.14.6 allows local attackers to cause a denial of service or potentially execute arbitrary code. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited exploitation likelihood.

Technical ContextAI

HDF5 is a data model, library, and file format for storing and managing large amounts of data. The vulnerability resides in the function H5FS__sect_find_node in H5FSsection.c, which is part of the free-space manager. The issue is a classic heap-based buffer overflow (CWE-119), where improper bounds checking allows writing beyond allocated heap memory. CPE data confirms all HDF5 versions up to 1.14.6 are affected.

RemediationAI

Upgrade to the latest patched version of HDF5 (1.14.7 or later) as per vendor advisory. The fix is available from the HDF Group. As a workaround, restrict local access to untrusted users and avoid processing untrusted HDF5 files. Monitor for updates from Ubuntu and Debian, which track this issue (Ubuntu priority medium, Debian bug#1108156).