CVE-2025-6516

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122 CWE-787

Affected software

Vendor	Product	Versions
n/a	HDF5	1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6

References

https://github.com/HDFGroup/hdf5/issues/5581Exploit, Issue Tracking, Third Party Advisory
https://github.com/user-attachments/files/20626851/reproduce.tar.gzExploit
https://vuldb.com/?ctiid.313636Permissions Required, VDB Entry
https://vuldb.com/?id.313636Third Party Advisory, VDB Entry
https://vuldb.com/?submit.592589Third Party Advisory, VDB Entry

Timeline

Published: Jun 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-65179.8A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-w CVE-2025-651767.5An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgen CVE-2025-65186.3A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode CVE-2025-651852.8There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by enteri CVE-2025-651866.1Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown CVE-2025-651876.1A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject CVE-2025-65199.8E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictab CVE-2025-651997.8A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe grou CVE-2025-65209.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQ CVE-2025-652009.6An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL CVE-2025-652028.0TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP CVE-2025-652037.1KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directiv