CVE-2022-25942
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10...
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-25942- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2022-30517
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
EUVD-2022-30517- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h4mx-hpfc-jg53
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10...
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
GHSA-h4mx-hpfc-jg53- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-25942- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-25942- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2022-25942
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
DEBIAN-CVE-2022-25942- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-25942
An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Record
UBUNTU-CVE-2022-25942- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2022-25942 No score
CVE-2022-25942 in hdf5 - Patched by Root
Root has patched CVE-2022-25942 in the hdf5 package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2022-25942- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2022-25942 No score
CVE-2022-25942 in hdf5 - Patched by Root
Root has patched CVE-2022-25942 in the hdf5 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2022-25942- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hdf5Debian:12 |
All versions, plus listed versions 1.10.10+repack-11.10.10+repack-21.10.10+repack-31.10.10+repack-3.11.10.10+repack-3.2 Show 45 moreShow less1.10.10+repack-3.2+ports1.10.10+repack-3.31.10.10+repack-41.10.10+repack-51.10.8+repack1-11.12.0+repack-1~exp11.12.0+repack-1~exp21.12.2+repack-1~exp11.14.3+repack-1~exp11.14.3+repack1-1~exp21.14.3+repack1-1~exp31.14.4.3+repack-1~exp11.14.4.3+repack-1~exp21.14.4.3+repack-1~exp31.14.5+repack-11.14.5+repack-1~exp11.14.5+repack-1~exp21.14.5+repack-1~exp31.14.5+repack-1~exp41.14.5+repack-1~exp51.14.5+repack-1~exp61.14.5+repack-21.14.5+repack-31.14.5+repack-3.11.14.5+repack-3~exp11.14.5+repack-3~exp21.14.5+repack-3~exp31.14.5+repack-3~exp41.14.5+repack-41.14.5+repack-4~exp11.14.5+repack-4~exp21.14.5+repack-5~exp21.14.5+repack-5~exp31.14.6+repack-11.14.6+repack-1~exp11.14.6+repack-1~exp101.14.6+repack-1~exp111.14.6+repack-1~exp121.14.6+repack-1~exp131.14.6+repack-1~exp141.14.6+repack-1~exp151.14.6+repack-1~exp161.14.6+repack-1~exp171.14.6+repack-1~exp181.14.6+repack-1~exp19 |
None known |
hdf5Debian:13 |
before 1.10.10+repack-1 | 1.10.10+repack-1 |
hdf5Debian:14 |
before 1.10.10+repack-1 | 1.10.10+repack-1 |
hdf5Root:Debian:11 |
before 1.10.6+repack-4+deb11u1.root.io.5 | 1.10.6+repack-4+deb11u1.root.io.51.10.6+repack-4+deb11u1.root.io.11.10.6+repack-4+deb11u1.root.io.21.10.6+repack-4+deb11u1.root.io.31.10.6+repack-4+deb11u1.root.io.41.10.6+repack-4+deb11u1.root.io.71.10.6+repack-4+deb11u1.root.io.81.10.6+repack-4+deb11u1.root.io.91.10.6+repack-4+deb11u1.root.io.101.10.6+repack-4+deb11u1.root.io.111.10.6+repack-4+deb11u1.aikido.12 |
rootio-hdf5Root:Debian:11 |
before 1.10.6+repack-4+deb11u1.root.io.5 | 1.10.6+repack-4+deb11u1.root.io.51.10.6+repack-4+deb11u1.root.io.11.10.6+repack-4+deb11u1.root.io.21.10.6+repack-4+deb11u1.root.io.31.10.6+repack-4+deb11u1.root.io.41.10.6+repack-4+deb11u1.root.io.71.10.6+repack-4+deb11u1.root.io.81.10.6+repack-4+deb11u1.root.io.91.10.6+repack-4+deb11u1.root.io.101.10.6+repack-4+deb11u1.root.io.111.10.6+repack-4+deb11u1.aikido.12 |
hdf5Root:Debian:12 |
before 1.10.8+repack1-1.root.io.18 | 1.10.8+repack1-1.root.io.181.10.8+repack1-1.root.io.131.10.8+repack1-1.root.io.191.10.8+repack1-1.root.io.91.10.8+repack1-1.root.io.101.10.8+repack1-1.root.io.111.10.8+repack1-1.root.io.121.10.8+repack1-1.root.io.141.10.8+repack1-1.root.io.151.10.8+repack1-1.root.io.161.10.8+repack1-1.root.io.171.10.8+repack1-1.root.io.201.10.8+repack1-1.root.io.211.10.8+repack1-1.root.io.221.10.8+repack1-1.root.io.231.10.8+repack1-1.root.io.281.10.8+repack1-1.root.io.241.10.8+repack1-1.root.io.251.10.8+repack1-1.root.io.261.10.8+repack1-1.root.io.271.10.8+repack1-1.root.io.291.10.8+repack1-1.root.io.301.10.8+repack1-1.root.io.311.10.8+repack1-1.root.io.321.10.8+repack1-1.aikido.33 |
rootio-hdf5Root:Debian:12 |
before 1.10.8+repack1-1.root.io.18 | 1.10.8+repack1-1.root.io.181.10.8+repack1-1.root.io.131.10.8+repack1-1.root.io.191.10.8+repack1-1.root.io.91.10.8+repack1-1.root.io.101.10.8+repack1-1.root.io.111.10.8+repack1-1.root.io.121.10.8+repack1-1.root.io.141.10.8+repack1-1.root.io.151.10.8+repack1-1.root.io.161.10.8+repack1-1.root.io.171.10.8+repack1-1.root.io.201.10.8+repack1-1.root.io.211.10.8+repack1-1.root.io.221.10.8+repack1-1.root.io.231.10.8+repack1-1.root.io.281.10.8+repack1-1.root.io.241.10.8+repack1-1.root.io.251.10.8+repack1-1.root.io.261.10.8+repack1-1.root.io.271.10.8+repack1-1.root.io.291.10.8+repack1-1.root.io.301.10.8+repack1-1.root.io.311.10.8+repack1-1.root.io.321.10.8+repack1-1.aikido.33 |
hdf5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.8.11-3ubuntu11.8.11-5ubuntu11.8.11-5ubuntu21.8.11-5ubuntu61.8.11-5ubuntu71.8.11-5ubuntu7.11.8.11-5ubuntu7.1+esm11.8.11-5ubuntu7.1+esm2 |
None known |
hdf5Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.8.15-patch1+docs-41.8.15-patch1+docs-51.8.16+docs-11.8.16+docs-21.8.16+docs-3 Show 6 moreShow less1.8.16+docs-3ubuntu11.8.16+docs-41.8.16+docs-4ubuntu11.8.16+docs-4ubuntu1.11.8.16+docs-4ubuntu1.1+esm11.8.16+docs-4ubuntu1.1+esm2 |
None known |
hdf5Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.10.0-patch1+docs-41.10.0-patch1+docs-4ubuntu0.1~esm11.10.0-patch1+docs-4ubuntu0.1~esm2 |
None known |
hdf5Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.10.4+repack-101.10.4+repack-111.10.4+repack-11ubuntu11.10.4+repack-11ubuntu1+esm1 |
None known |
hdf5Ubuntu:22.04:LTS |
All versions, plus listed versions 1.10.6+repack-51.10.7+repack-4ubuntu11.10.7+repack-4ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25942 is a high vulnerability (CVSS 7.8) in Hdf5 Group Libhdf5, published August 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in hdf5 1.10.10+repack-1.
References
talosintelligence.com/vulnerability_reports/TALOS-2022-1486
nvd.nist.gov/vuln/detail/CVE-2022-25942
github.com/advisories/GHSA-h4mx-hpfc-jg53
security-tracker.debian.org/tracker/CVE-2022-25942
ubuntu.com/security/CVE-2022-25942
cve.org/CVERecord?id=CVE-2022-25942
Left out here: 28 versions. The JSON record has them.