CVE-2025-2925

HDF5 H5MM.c H5MM_realloc double free

State: Published
Severity: 4.8 Medium
Published: Mar 28, 2025
Updated: Jul 24, 2025
Reserved: Mar 28, 2025

Description

A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-415 Double Free
CWE-119 Memory Corruption

Affected Products

Product	Versions
HDF5n/a	1.14.0Affected 1.14.1Affected 1.14.2Affected 1.14.3Affected 1.14.4Affected 1.14.5Affected 1.14.6Affected

References

VDB-301900 | HDF5 H5MM.c H5MM_realloc double freevdb-entrytechnical-description
VDB-301900 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #521193 | https://github.com/HDFGroup/hdf5 HDF5 1.14.6 Double Freethird-party-advisory
https://github.com/HDFGroup/hdf5/issues/5383exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.