Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-2912

17
FAUCET Score

CVE-2025-2912 is a heap-based buffer overflow vulnerability affecting HDF5 versions up to 1.14.6, specifically within the H5O_msg_flush function in src/H5Omessage.c. This vulnerability carries a CVSS score of 5.3 (Medium), indicating a local attack vector with low complexity and potential for limited impact on confidentiality, integrity, and availability. While the exploit has been publicly disclosed, there is currently no evidence of active exploitation, nor are there readily available exploit modules in common frameworks like Metasploit or Nuclei, and it has garnered minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.0.0CPE matchmatch criteria
cpe:2.3:a:hdfgroup:hdf5:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

1.9LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
LOW
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
PROOF_OF_CONCEPT
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.26%
Probability of exploitation in next 30 days
EPSS Percentile
17.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0026 is in the 70th percentile among its peer group of 15,940 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (2)

github_advisoryvendor investigatingvia nvd_reference
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: hdf5

Vendor Advisories (2)

redhatCVE-2025-2912Low

hdf5: HDF5 H5Omessage.c H5O_msg_flush heap-based overflow

Mar 28, 2025
microsoft2025-Mar/CVE-2025-2912

HDF5 H5Omessage.c H5O_msg_flush heap-based overflow

Mar 11, 2025

References

github.com / HDFGroup/hdf5/issues/5370
ExploitIssue TrackingVendor Advisory
vuldb.com
Permissions RequiredVDB Entry
vuldb.com
Third Party AdvisoryVDB Entry
vuldb.com
Third Party AdvisoryVDB Entry