CVE-2025-6856: HDF5 H5FL.c H5FL__reg_gc_list use after free
A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FLreggclist of the file src/H5FL.c. The manipulation leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Other sources
HDF5 H5FL.c H5FLreggclist use after free
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6856?
CVE-2025-6856 is classified as a problematic vulnerability due to the use-after-free error that can be exploited.
How do I fix CVE-2025-6856?
To mitigate CVE-2025-6856, it is recommended to upgrade to the latest version of HDF5, as patches may resolve the vulnerability.
What systems are affected by CVE-2025-6856?
CVE-2025-6856 specifically affects HDF5 version 1.14.6 from the HDF Group.
Can CVE-2025-6856 be exploited remotely?
No, CVE-2025-6856 requires local access to exploit the vulnerability.
What type of vulnerability is CVE-2025-6856?
CVE-2025-6856 is a use-after-free vulnerability that arises in the function H5FL__reg_gc_list.