CVE-2025-6816

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
n/a	HDF5	1.14.6

References

https://github.com/HDFGroup/hdf5/issues/5571Exploit, Issue Tracking
https://github.com/user-attachments/files/20623354/hdf5_crash_3.txtExploit
https://vuldb.com/?ctiid.314254Permissions Required, VDB Entry
https://vuldb.com/?id.314254Third Party Advisory, VDB Entry
https://vuldb.com/?submit.602291Third Party Advisory, VDB Entry
https://github.com/HDFGroup/hdf5/issues/5571Exploit, Issue Tracking

Timeline

Published: Jun 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-681604.7Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes ca CVE-2025-681614.8The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificat CVE-2025-681622.7In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration CVE-2025-681634.8In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page CVE-2025-681642.7In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test CVE-2025-681656.1In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup CVE-2025-681666.1In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab CVE-2025-681677.8In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix invalid pointer access in debugfs If the memory allocatio CVE-2025-681687.8In the Linux kernel, the following vulnerability has been resolved: jfs: fix uninitialized waitqueue in transaction manager The transactio CVE-2025-68169In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix deadlock in memory allocation under spinlock Fix a AA dea CVE-2025-68173.3A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the CVE-2025-681707.8In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree() devres managed rdev Since the allocation of