CVE-2025-2153: HDF5 h5 File H5SM.c H5SM_delete heap-based overflow
Vulnerability summary
CVE-2025-2153 is a high (CVSS 8.1) vulnerability in hdfgroup hdf5. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 10-03-2025PublishedVulnerability first disclosed.
- 12-05-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST5.1MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.50% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundCrashes
Maturity: poc
Hdf5
Maturity: poc
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
- CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu5 products
- hdf5All versions (No fix recorded)
- insighttoolkitAll versions (No fix recorded)
- insighttoolkit4All versions (No fix recorded)
- insighttoolkit5All versions (No fix recorded)
- paraviewAll versions (No fix recorded)
Debian1 product
- hdf5All versions (No fix recorded) | < 2.1.0+repack-1
Hdfgroup1 product
- hdf51.14.6
3 vendors · 7 products
