HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow
Priority MEDIUM 55CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HDF5 | 1.14.6 | — | No fix listed | CNA |
- HDF5 Vendor— Affected 1.14.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hdfgroup:hdf5:1.14.6:*:*:*:*:*:*:* | 1.14.6 | Vulnerable | The HDF Group |
- cpe:2.3:a:hdfgroup:hdf5:1.14.6:*:*:*:*:*:*:* Versions 1.14.6 Vulnerable ·The HDF Group
Remediation
Red Hat 1 advisory
- RHSA-2025:23731 Released 2025-12-22 · Red Hat rating LowRHEL AI 3.0 hdf5 security update
- Red Hat Enterprise Linux AI 3.0 for RHEL 9 hdf5-1.14.6-6.el9ai, hdf5-devel-1.14.6-6.el9ai, hdf5-openmpi-1.14.6-6.el9ai +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI 3.0 for RHEL 9 | Fixed | RHSA-2025:23731 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2310
- 2026-10-03 Alias added: GHSA-qxwf-xj2v-qm83
References
More The HDF Group Hdf5 vulnerabilities
- TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
- TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
- TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
- TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
- TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
- TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
Sources
- CVE-2025-2310 · CVE Program
- CVE-2025-2310 · NVD
- FIRST EPSS
- GHSA-qxwf-xj2v-qm83 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-2310 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences