CVE-2025-2925 Details
Description
A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
A double free vulnerability has been identified in the HDF5 library, affecting versions through 1.14.6. The issue arises in the memory management functions `H5MM_realloc` and `H5MM_xfree`, located in `src/H5MM.c`. The vulnerability occurs when `H5MM_realloc` is used to release memory by passing a size of zero, without subsequently nullifying the pointer. This oversight leads to a double free when `H5MM_xfree` is called, creating a potential for application crashes.
Users are advised to update to HDF5 version 1.14.6 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HDFGroup/hdf5/issues/5383 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://github.com/HDFGroup/hdf5/issues/5383 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://vuldb.com/?ctiid.301900 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.301900 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.521193 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hdfgroup hdf5 | <= 1.14.6 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Jul 24, 2025 | CVE Modified | [email protected] |
| Apr 17, 2025 | Initial Analysis | [email protected] |
| Mar 28, 2025 | CVE Modified | CISA-ADP |
| Mar 28, 2025 | New CVE Received | [email protected] |