CVE-2025-2309
Published: 14 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-2309 is a critical heap-based buffer overflow vulnerability affecting HDF5 version 1.14.6, specifically in the H5T__bit_copy function of the Type Conversion Logic component. The issue, published on 2025-03-14, is linked to CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-122 (Heap-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). Manipulation of the function triggers the overflow.
Local access is required for exploitation, targeting systems where an attacker has low privileges (PR:L). The attack has low complexity (AC:L) and needs no user interaction (UI:N), with a CVSS v3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). A successful exploit can lead to limited impacts on confidentiality, integrity, and availability, potentially allowing partial data exposure, modification, or denial of service.
Advisories from VulDB indicate the exploit has been publicly disclosed, including a proof-of-concept on GitHub at https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc3.md. The vendor plans to fix the issue in an upcoming release, but no patch is currently available. Practitioners should restrict local access, monitor for updates, and test applications using HDF5 1.14.6.
Details
- CWE(s)
Affected Products
AI Security Analysis
- AI Category
- Data Processing Libraries
- Risk Domain
- Data-Related Vulnerabilities
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- HDF5 is a widely used library for storing and managing large, complex datasets in scientific computing, including machine learning pipelines for data loading and processing during training.
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Heap-based buffer overflow in HDF5 type conversion enables arbitrary code execution via client application exploitation (T1203), potential privilege escalation (T1068), and application crashes for DoS (T1499.004) when processing malicious files locally.