CVE-2025-44905: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability was discovered in hdf5 version 1.14.6, specifically affecting the H5Z__filter_scaleoffset function. The vulnerability was disclosed on May 30, 2025, and has been assigned the identifier CVE-2025-44905. The issue affects multiple distributions including Debian's bullseye, bookworm, trixie, and sid releases (Debian Tracker, NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) that occurs when the H5Z__filter_scaleoffset function reads 1 byte beyond a 1-byte heap allocation. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H according to CISA-ADP assessment (Wiz, NVD).

The vulnerability can lead to memory corruption and application crashes when processing malformed HDF5 files using the Scale-Offset filter. This can potentially result in high impacts on confidentiality, integrity, and availability of the affected systems (Wiz).

As of the current date, mitigation options are either not available or do not meet Red Hat Product Security criteria for ease of use, deployment, and stability. Red Hat Enterprise Linux AI (RHEL AI) has deferred fixing this issue (Wiz).