HDF5 H5MM.c H5MM_realloc double free
Priority MEDIUM 55CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Deferred Red Hat: fix deferred
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HDF5 | 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6 | — | No fix listed | CNA |
- HDF5 Vendor— Affected 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* | up to 1.14.6 | Vulnerable | The HDF Group |
- cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 1.14.6 Vulnerable ·The HDF Group
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2925
- 2026-10-03 Alias added: GHSA-8j53-82pv-32wq
References
More The HDF Group Hdf5 vulnerabilities
- TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
- TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
- TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
- TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
- TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
- TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
Sources
- CVE-2025-2925 · CVE Program
- CVE-2025-2925 · NVD
- FIRST EPSS
- GHSA-8j53-82pv-32wq · GitHub Advisory Database · CC BY 4.0
- CVE-2025-2925 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences