CVE-2025-2926

A vulnerability was found in HDF5 up to 1.14.6 and classified as problematic. This issue affects the function H5O__cache_chk_serialize of the file src/H5Ocache.c. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Weakness 

The product does not release or incorrectly releases a resource before it is made available for re-use.

Potential Mitigations 

• Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
• For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.

Related Attack Patterns 

• https://cwe.mitre.org/data/definitions/125.html
• https://cwe.mitre.org/data/definitions/130.html
• https://cwe.mitre.org/data/definitions/131.html
• https://cwe.mitre.org/data/definitions/494.html
• https://cwe.mitre.org/data/definitions/495.html
• https://cwe.mitre.org/data/definitions/496.html
• https://cwe.mitre.org/data/definitions/666.html

References  

• https://github.com/HDFGroup/hdf5/issues/5384
• https://vuldb.com/?ctiid.301901
• https://vuldb.com/?id.301901
• https://vuldb.com/?submit.521246
• https://github.com/HDFGroup/hdf5/issues/5384