CVE-2025-2926

EUVD-2025-8654
A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache.c. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Affected Products (NVD)
VendorProductVersion
hdfgrouphdf5
𝑥
≤ 1.14.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
hdf5
bookworm
unimportant
bullseye
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Azure Linux logo
Azure Linux Releases
Azure Package
Release
hdf5
Azure Linux 3.0
0:1.14.6-1.azl3
fixed
CBL-Mariner 2.0
0:1.14.6-1.cm2
fixed
Common Weakness Enumeration
References
https://github.com/HDFGroup/hdf5/issues/5384
https://vuldb.com/?ctiid.301901
https://vuldb.com/?id.301901
https://vuldb.com/?submit.521246
https://github.com/HDFGroup/hdf5/issues/5384