CVE-2025-2309

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T_bitcopy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2309.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.14.6"
                },
                {
                    "last_affected": "1.14.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/hdfgroup/hdf5

Affected ranges

Type

GIT

Repo

https://github.com/hdfgroup/hdf5

Events

Introduced

7bf340440909d468dbb3cf41f0ea0d87f5050cea

Last affected

7bf340440909d468dbb3cf41f0ea0d87f5050cea

Database specific

{
    "cpe": "cpe:2.3:a:hdfgroup:hdf5:1.14.6:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.14.6"
        },
        {
            "last_affected": "1.14.6"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.14.6

hdf5-1.*

hdf5-1.14.6

hdf5_1.*

hdf5_1.14.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2309.json"