Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
HDF5 before 1.14.6‑1 can be crashed locally
published 1 year ago
Summary
The HDF5 data library versions earlier than 1.14.6‑1 contain a coding error that can cause a memory overflow when a specific function is used. An attacker with access to the same computer could exploit this to make the program crash or run unwanted code. Update HDF5 to version 1.14.6‑1 or later to remove the risk.
What to do
- Update azure hdf5 to version 1.14.6-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | hdf5 |
< 1.14.6-1 Fix: upgrade to 1.14.6-1
|
Original advisory text
CVE-2025-6857 affecting package hdf5 for versions less than 1.14.6-1
A vulnerability has been found in HDF5 1.14.6 and classified as problematic. Affected by this vulnerability is the function H5G__node_cmp3 of the file src/H5Gnode.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
References
Timeline
Published29 Jun 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-64431 · OSV
Track software like this
Free during beta