← back
CVE-2025-2310

HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow

CVSS 4.8 MEDIUMEPSS 0.4%CWE-119CWE-122
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
14 Mar 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
n/a · HDF5
References
https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.mdhttps://vuldb.com/?ctiid.299723https://vuldb.com/?id.299723https://vuldb.com/?submit.514533