CVE-2025-6857: 
NixOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability (CVE-2025-6857) was discovered in HDF5 version 1.14.6, specifically affecting the H5G__node_cmp3 function in src/H5Gnode.c. The vulnerability was disclosed on June 29, 2025, and is tracked with various severity ratings from different sources (NVD, VulDB).

The vulnerability manifests as a stack-based buffer overflow in the H5G__node_cmp3 function. The CVSS scores vary significantly between assessment bodies, with NVD assigning a CVSS v3.1 base score of 7.8 (HIGH) while VulDB rates it at 3.3 (LOW). The CVSS v4.0 score from VulDB is 4.8 (MEDIUM). The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow) (NVD).

The vulnerability allows for local attacks that could potentially lead to system compromise. While the attack requires local access and low privileges, it can affect system availability and potentially lead to arbitrary code execution through buffer overflow exploitation (NVD).

No official patch has been released yet for this vulnerability. The issue is currently under evaluation for multiple Ubuntu releases, including 25.04, 24.04 LTS, 22.04 LTS, and earlier versions (Ubuntu).