CVE-2025-2309 HDF5 Type Conversion Logic H5T__bit_copy heap-based overflow

Medium 4.8 Published 14 Mar 2025 Updated 8 May 2025

A heap-based buffer overflow in HDF5's type conversion logic allows local attackers to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-2309?

CVE-2025-2309 is a medium-severity memory corruption vulnerability in Hdfgroup Hdf5, published on 14 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Weakness: CWE-122, CWE-787, CWE-119

Which versions are affected by CVE-2025-2309?

It affects 1 product.

Products include Hdfgroup Hdf5.

How do I fix CVE-2025-2309?

No fix published yet.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-2309 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2309 exists.

All Hdfgroup Hdf5 vulnerabilities

Sources

Also known as AZL-58813, AZL-58819, DEBIAN-CVE-2025-2309, ECHO-0e1f-95c8-bbac, GHSA-76vw-8gm2-pwmh, JLSEC-2026-327 and 1 more.