Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Azure HDF5 up to 1.14.6 allows local memory overflow

published 1 year ago
Summary

The HDF5 library used in Azure versions before 1.14.6 can be tricked into writing beyond its allocated memory when a specific input is crafted. This could cause the program to crash or be taken over by an attacker who has local access to the system. Update the HDF5 package to version 1.14.6 or later to eliminate the risk.

What to do
  • Update azure hdf5 to version 1.14.6-2.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure hdf5 < 1.14.6-2
Fix: upgrade to 1.14.6-2
Original advisory text
CVE-2025-2915 affecting package hdf5 for versions less than 1.14.6-2
A vulnerability classified as problematic was found in HDF5 up to 1.14.6. This vulnerability affects the function H5F__accum_free of the file src/H5Faccum.c. The manipulation of the argument overlap_size leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Timeline
Published28 Mar 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-59388 · OSV
Track software like this
Free during beta