CVE-2025-6858

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in HDF5 1.14.6 and classified as problematic. Affected by this issue is the function H5C__flush_single_entry of the file src/H5Centry.c. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
n/a	HDF5	1.14.6

References

https://github.com/HDFGroup/hdf5/issues/5576Exploit, Issue Tracking, Third Party Advisory
https://github.com/user-attachments/files/20623475/hdf5_crash_8.txtExploit
https://vuldb.com/?ctiid.314330Permissions Required
https://vuldb.com/?id.314330Third Party Advisory, VDB Entry
https://vuldb.com/?submit.602530Third Party Advisory, VDB Entry

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-685804.3Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro a CVE-2025-685815.4Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Co CVE-2025-685825.3Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control CVE-2025-685834.3Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forge CVE-2025-685844.3Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Reque CVE-2025-685852.7Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Acces CVE-2025-685865.3Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2025-685874.3Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue CVE-2025-685884.3Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.Thi CVE-2025-685895.3Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured CVE-2025-68598.8A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown pa CVE-2025-685907.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form