CVE-2025-2914: 
NixOS vulnerability analysis and mitigation

A vulnerability classified as problematic has been found in HDF5 up to version 1.14.6. The vulnerability affects the function H5FS__sinfo_Srialize_Sct_cb in the file src/H5FScache.c. The issue was discovered on March 28, 2025 and involves a heap-based buffer overflow vulnerability when manipulating the argument sect (NVD, GitHub Issue).

The vulnerability occurs in the H5FS__sinfo_serialize_sect_cb function where UINT64ENCODE_VAR macro is used without proper boundary checks, resulting in at least 1 byte overflow. The issue manifests when processing certain files, leading to an out-of-bounds write operation beyond the allocated memory. The vulnerability has been assigned CVSS v3.1 base score of 3.3 (LOW) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (NVD).

The heap-based buffer overflow can lead to application crashes and potential memory corruption. Local access is required to exploit this vulnerability. The impact is primarily on the availability of the system, with no direct effect on confidentiality or integrity (GitHub Issue).

The vulnerability affects HDF5 versions up to 1.14.6. Users are advised to update to newer versions once a patch becomes available. Currently, there are no official fixes or workarounds published (Debian Tracker).