Is there a public PoC exploit available for CVE-2025-6816?

Yes, a public proof-of-concept exploit is available for CVE-2025-6816. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2025-6816?

Yes, a patch is available for CVE-2025-6816. Update the affected software to the latest version immediately.

HDF5 CVE-2025-6816

Q: What is the CVSS score of CVE-2025-6816?

CVE-2025-6816 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-19446 LOW

Buffer Overflow (CWE-119)

2025-06-28 cna@vuldb.com

Buffer Overflow Hdf5

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local attack, low privileges, no confidentiality/integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Ubuntu

LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 01:05 euvd

EUVD-2025-19446

Analysis Generated

Mar 16, 2026 - 01:05 vuln.today

PoC Detected

Jul 01, 2025 - 17:32 vuln.today

Public exploit code

CVE Published

Jun 28, 2025 - 08:15 cve.org

LOW 1.9

CVE Published

Jun 28, 2025 - 08:15 nvd

LOW 3.3

DescriptionCVE.org

A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

AnalysisAI

Heap buffer overflow in HDF5 1.14.6 allows local authenticated low-privilege users to cause a denial of service via a crafted file. Public exploit code exists, but no active exploitation has been confirmed (CISA KEV not listed); EPSS probability is very low (0.05%).

Technical ContextAI

HDF5 is a hierarchical data format commonly used in scientific and HPC environments. The vulnerability resides in the H5O__fsinfo_encode function within /src/H5Ofsinfo.c, which handles file storage information encoding. CWE-119 indicates a buffer overflow, specifically on the heap. The affected CPE is cpe:2.3:a:hdfgroup:hdf5:1.14.6. Ubuntu and Debian track this issue as low priority, confirming limited real-world impact for most deployments.

RemediationAI

Upgrade to the patched version provided by the vendor (HDFGroup fix available in issue #5571). No specific patched version number has been released; monitor the HDF5 repository for a formal release. As a workaround, restrict local access to untrusted users who could supply malicious HDF5 files. Side effects: disabling file operations that rely on the affected function may break legitimate applications.