CVE-2025-2912

Name of the Vulnerable Software and Affected Versions HDF5 versions up to 1.14.6

Description A heap-based buffer overflow issue has been identified, affecting the H5O msg flush function in the file src/H5Omessage.c. The manipulation of the oh argument leads to this issue. The attack requires local access.

Recommendations For HDF5 versions up to 1.14.6, consider restricting access to the H5O msg flush function until a patch is available. As a temporary workaround, avoid using the oh argument in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.