CVE-2025-2924

A vulnerability, which was classified as problematic, was found in HDF5 up to 1.14.6. This affects the function H5HL__fl_deserialize of the file src/H5HLcache.c. The manipulation of the argument free_block leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

• CWE-119
• CWE-122
• CWE-787

• https://github.com/HDFGroup/hdf5/issues/5382Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.301899Permissions Required, VDB Entry
• https://vuldb.com/?id.301899Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.521170Third Party Advisory, VDB Entry
• https://github.com/HDFGroup/hdf5/issues/5382Exploit, Issue Tracking, Third Party Advisory

Published

Mar 28, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29227In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua f…6.3
• CVE-2025-29228Linksys E5600 V1.1.0.26 is vulnerable to command injection i…9.8
• CVE-2025-29229linksys E5600 V1.1.0.26 is vulnerable to command injection i…9.8
• CVE-2025-2923A vulnerability, which was classified as problematic, has be…3.3
• CVE-2025-29230Linksys E5600 v1.1.0.26 was discovered to contain a command …8.6
• CVE-2025-29231A stored cross-site scripting (XSS) vulnerability in the pag…6.1
• CVE-2025-2925A vulnerability has been found in HDF5 up to 1.14.6 and clas…5.5
• CVE-2025-2926A vulnerability was found in HDF5 up to 1.14.6 and classifie…5.5
• CVE-2025-29266Unraid 7.0.0 before 7.0.1 allows remote users to access the …9.6
• CVE-2025-29267SQL Injection vulnerability in Abis, Inc Adjutant Core Accou…6.5
• CVE-2025-29268ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded …9.8
• CVE-2025-29269ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS co…9.8