HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow
Priority MEDIUM 55CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HDF5 | 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6 | — | No fix listed | CNA |
- HDF5 Vendor— Affected 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* | up to 1.14.6 | Vulnerable | The HDF Group |
- cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:* Versions up to 1.14.6 Vulnerable ·The HDF Group
Remediation
Red Hat 1 advisory
- RHSA-2025:23731 Released 2025-12-22 · Red Hat rating LowRHEL AI 3.0 hdf5 security update
- Red Hat Enterprise Linux AI 3.0 for RHEL 9 hdf5-1.14.6-6.el9ai, hdf5-devel-1.14.6-6.el9ai, hdf5-openmpi-1.14.6-6.el9ai +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI 3.0 for RHEL 9 | Fixed | RHSA-2025:23731 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-6516
- 2026-10-03 Alias added: GHSA-r9x6-p32f-jfm3
References
More The HDF Group Hdf5 vulnerabilities
- TI-2025-28698 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. CVSS 3.1HIGH 8.8
- TI-2025-28697 hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. CVSS 3.1HIGH 8.8
- TI-2020-13412 Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote… CVSS 3.1HIGH 8.8
- TI-2021-15413 Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows… CVSS 3.1HIGH 7.5
- TI-2026-26978 HDF5: H5T__conv_struct Use After Free CVSS 3.1HIGH 7.8
- TI-2022-09532 Heap-based buffer overflow in HDF Group libhdf5 CVSS 3.1HIGH 7.8
Sources
- CVE-2025-6516 · CVE Program
- CVE-2025-6516 · NVD
- FIRST EPSS
- GHSA-r9x6-p32f-jfm3 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-6516 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences