Skip to main content

HDF5 EUVDEUVD-2025-19446

| CVE-2025-6816 LOW
Buffer Overflow (CWE-119)
2025-06-28 cna@vuldb.com
Buffer Overflow Hdf5
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local attack, low privileges, no confidentiality/integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
CVSS changed
Apr 29, 2026 - 01:11 NVD
3.3 (LOW) 1.9 (LOW)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 16, 2026 - 01:05 euvd
EUVD-2025-19446
Analysis Generated
Mar 16, 2026 - 01:05 vuln.today
PoC Detected
Jul 01, 2025 - 17:32 vuln.today
Public exploit code
CVE Published
Jun 28, 2025 - 08:15 cve.org
LOW 1.9
CVE Published
Jun 28, 2025 - 08:15 nvd
LOW 3.3

DescriptionCVE.org

A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

AnalysisAI

Heap buffer overflow in HDF5 1.14.6 allows local authenticated low-privilege users to cause a denial of service via a crafted file. Public exploit code exists, but no active exploitation has been confirmed (CISA KEV not listed); EPSS probability is very low (0.05%).

Technical ContextAI

HDF5 is a hierarchical data format commonly used in scientific and HPC environments. The vulnerability resides in the H5O__fsinfo_encode function within /src/H5Ofsinfo.c, which handles file storage information encoding. CWE-119 indicates a buffer overflow, specifically on the heap. The affected CPE is cpe:2.3:a:hdfgroup:hdf5:1.14.6. Ubuntu and Debian track this issue as low priority, confirming limited real-world impact for most deployments.

RemediationAI

Upgrade to the patched version provided by the vendor (HDFGroup fix available in issue #5571). No specific patched version number has been released; monitor the HDF5 repository for a formal release. As a workaround, restrict local access to untrusted users who could supply malicious HDF5 files. Side effects: disabling file operations that rely on the affected function may break legitimate applications.

More in Hdf5

View all
CVE-2018-13876 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13874 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13873 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13872 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13871 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13870 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13869 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13868 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13867 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2018-13866 CRITICAL POC
9.8 Jul 10

An issue was discovered in the HDF HDF5 1.8.20 library. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2017-17509 HIGH POC
8.8 Dec 11

In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhd
CVE-2025-44904 HIGH POC
8.8 May 30

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Rated high severity (CVSS

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Low
hdf5
Release Status Version
xenial not-affected code not present
jammy needed -
noble needed -
oracular ignored end of life, was needs-triage
bionic not-affected code not present
focal needed -
questing needed -
trusty not-affected code not present
plucky ignored end of life, was needs-triage
upstream released 2.0.0

Debian

Bug #1108482
hdf5
Release Status Fixed Version Urgency
bullseye vulnerable 1.10.6+repack-4+deb11u1 -
bookworm vulnerable 1.10.8+repack1-1 -
trixie vulnerable 1.14.5+repack-3 -
forky, sid vulnerable 1.14.6+repack-2 -
(unstable) fixed (unfixed) unimportant

Share

EUVD-2025-19446 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy