VulnerabilityAnalyzed
CVE-2025-2308
A vulnerability, which was classified as critical, was found in HDF5 1.14.6.
MEDIUM 4.8EPSS 0.40%
Does this matter?
Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
- CVSS 4.0
- 4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.40% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-122, CWE-787
- Affected
- hdfgroup/hdf5
- Source
- cna@vuldb.com
References
- https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc2.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.299721Permissions Required, VDB Entry
- https://vuldb.com/?id.299721Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.514531Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.