Skip to content
OpenAdvisories
Medium RHSA-2025:23731 3 CVEs

Red Hat Security Advisory: RHEL AI 3.0 hdf5 security update

Published Dec 22, 2025 · Updated Sep 23, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-debuginfo 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-debugsource 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-devel 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-openmpi 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-openmpi-debuginfo 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-openmpi-devel 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-openmpi-static 0:1.14.6-6.el9ai
Red Hat · Enterprise Linux Ai 3 enterprise_linux_ai:3.0::el9 hdf5-static 0:1.14.6-6.el9ai

Vulnerabilities 3

  • Medium 5.3
    CVE-2025-2310

    HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow

    A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploi…

    hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2025-6269

    HDF5 H5Cimage.c H5C__reconstruct_cache_entry heap-based overflow

    A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement…

    hdf5 hdf5 hdf5 Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2025-6516

    HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow

    A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached lo…

    hdf5 hdf5 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://issues.redhat.com/browse/AIPCC-8004
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23731.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-2310
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2352651
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-2310
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-2310
  • article
    https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md
  • article
    https://vuldb.com/?ctiid.299723
  • article
    https://vuldb.com/?id.299723
  • article
    https://vuldb.com/?submit.514533
  • report
    https://access.redhat.com/security/cve/CVE-2025-6269
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373903
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6269
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6269
  • article
    https://github.com/HDFGroup/hdf5/commit/7f27ba8c3a8483c3d7e5e2cb21fefb2c7563422d
  • article
    https://github.com/HDFGroup/hdf5/issues/5579
  • article
    https://github.com/user-attachments/files/20626503/reproduce.tar.gz
  • article
    https://vuldb.com/?ctiid.313273
  • article
    https://vuldb.com/?id.313273
  • article
    https://vuldb.com/?submit.592587
  • report
    https://access.redhat.com/security/cve/CVE-2025-6516
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2374364
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6516
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6516
  • article
    https://github.com/HDFGroup/hdf5/issues/5581
  • article
    https://github.com/user-attachments/files/20626851/reproduce.tar.gz
  • article
    https://vuldb.com/?ctiid.313636
  • article
    https://vuldb.com/?id.313636
  • article
    https://vuldb.com/?submit.592589