CVE-2025-2153

Name of the Vulnerable Software and Affected Versions HDF5 version 1.14.6

Description A critical issue was found in the H5SM delete function of the h5 File Handler component, located in the H5SM.c file. This issue leads to a heap-based buffer overflow. The attack can be launched remotely, but it has a high complexity and is considered difficult to exploit. The exploit has been publicly disclosed.

Recommendations For HDF5 version 1.14.6, as a temporary workaround, consider disabling the H5SM delete function until a patch is available. Restrict access to the h5 File Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.