CVE-2025-2310
A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
- Score
- CVSS 3.1 7.8 High
- Status
- Analyzed - cna@vuldb.com
- Published
- 2025-03-14
- Last modified
- 2025-05-08
- Weaknesses
- CWE-119, CWE-122, CWE-787
Affected products
References
- https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md
- https://vuldb.com/?ctiid.299723
- https://vuldb.com/?id.299723
- https://vuldb.com/?submit.514533
