cve 2025 2310

CVE-2025-2310 is a heap-overflow vulnerability in the HDF5 library, specifically in the H5MM_strndup function within the metadata attribute decoder. The flaw affects HDF5 version 1.14.6 and produces reproducible crashes. Microsoft has identified Azure Linux as a Microsoft product that includes this open-source library and is therefore potentially affected. Microsoft plans to expand CSAF/VEX attestations if additional Microsoft products are discovered to ship the same vulnerable component. Discussions on WindowsForum cover the technical details of the vulnerability, its impact on systems using HDF5, and Microsoft's response regarding affected products.