PT-2025-11306 · Hdf5+1 · Hdf5+1
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
HDF5 version 1.14.6
Description
A critical issue affects the function
H5MM strndup of the component Metadata Attribute Decoder, leading to heap-based buffer overflow. The manipulation requires local attacking. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.Recommendations
For HDF5 version 1.14.6, as a temporary workaround, consider disabling the
H5MM strndup function until a patch is available.Exploit
Fix
Heap Based Buffer Overflow
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Hdf5