CVE-2025-2913 | THREATINT

Description

A vulnerability was found in HDF5 up to 1.14.6. It has been rated as problematic. Affected by this issue is the function H5FL__blk_gc_list of the file src/H5FL.c. The manipulation of the argument H5FL_blk_head_t leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Eine problematische Schwachstelle wurde in HDF5 bis 1.14.6 ausgemacht. Es geht hierbei um die Funktion H5FL__blk_gc_list der Datei src/H5FL.c. Mit der Manipulation des Arguments H5FL_blk_head_t mit unbekannten Daten kann eine use after free-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-03-28 | Published 2025-03-28 | Updated 2025-03-28 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

LOW: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

1.7AV:L/AC:L/Au:S/C:N/I:N/A:P

Problem types

Use After Free

Memory Corruption

Timeline

2025-03-28:	Advisory disclosed
2025-03-28:	VulDB entry created
2025-03-28:	VulDB entry last update

References

vuldb.com/?id.301886 (VDB-301886 | HDF5 H5FL.c H5FL__blk_gc_list use after free) vdb-entry technical-description

vuldb.com/?ctiid.301886 (VDB-301886 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.520404 (Submit #520404 | https://github.com/HDFGroup/hdf5 HDF5 v1.14.6 Use After Free) third-party-advisory

github.com/HDFGroup/hdf5/issues/5376 exploit issue-tracking

cve.org (CVE-2025-2913)

nvd.nist.gov (CVE-2025-2913)

Download JSON