GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-92627 (GCVE-0-2026-92627)

Vulnerability from cvelistv5 – Published: 2026-09-16 15:16 – Updated: 2026-09-17 17:36
VLAI
Title
Heap Use-After-Free in H5T__conv_f_f
Summary
A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.
Severity
4.6 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:36 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
The HDF Group HDF5 Affected: < 1.14.2
guessed Create a notification for this product.
Credits
Denis Andzakovic
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:36:04.378638Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:36:14.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "src/H5Tconv.c"
          ],
          "product": "HDF5",
          "vendor": "The HDF Group",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Denis Andzakovic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA heap-use-after-free vulnerability exists in \u003ccode\u003eH5T__conv_f_f()\u003c/code\u003e in \u003ccode\u003esrc/H5Tconv.c\u003c/code\u003e in HDF5 before 1.14.2.\u0026nbsp;\u003cspan\u003eWhen converting a compound datatype containing floating-point members during a dataset read\u003c/span\u003e\u003cspan\u003e, a temporary buffer allocated with \u003c/span\u003e\u003ccode\u003ecalloc()\u003c/code\u003e\u003cspan\u003e is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 \u003c/span\u003e\u003cspan\u003efile containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as \u003c/span\u003e\u003ccode\u003eh5dump\u003c/code\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThis can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2.\u00a0When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump.\u00a0This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T15:58:14.633Z",
        "orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "shortName": "HDFG"
      },
      "references": [
        {
          "url": "https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap Use-After-Free in H5T__conv_f_f",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
    "assignerShortName": "HDFG",
    "cveId": "CVE-2026-92627",
    "datePublished": "2026-09-16T15:16:54.160Z",
    "dateReserved": "2026-09-16T15:14:38.985Z",
    "dateUpdated": "2026-09-17T17:36:14.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-92627",
      "date": "2026-09-18",
      "epss": "0.0022",
      "percentile": "0.12771"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "modules": [
                  "src/H5Tconv.c"
                ],
                "product": "HDF5",
                "vendor": "The HDF Group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.14.2"
                  }
                ]
              }
            ],
            "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2.\u00a0When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump.\u00a0This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution."
          }
        ],
        "id": "CVE-2026-92627",
        "lastModified": "2026-09-17T18:17:14.803",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-92627",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:36:04.378638Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-16T16:17:23.993",
        "references": [
          {
            "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
            "url": "https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption"
          }
        ],
        "sourceIdentifier": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-18T10:44:36+00:00",
      "cve": "CVE-2026-92627",
      "id": "CVE-2026-92627",
      "initial_release_date": "2026-09-16T15:16:54.160000+00:00",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "HDF5: HDF5: Memory corruption via crafted HDF5 file",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92627.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-92627",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-17T17:36:04.378638Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-17T17:36:11.594Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "modules": [
                "src/H5Tconv.c"
              ],
              "product": "HDF5",
              "vendor": "The HDF Group",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.14.2"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Denis Andzakovic"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA heap-use-after-free vulnerability exists in \u003ccode\u003eH5T__conv_f_f()\u003c/code\u003e in \u003ccode\u003esrc/H5Tconv.c\u003c/code\u003e in HDF5 before 1.14.2.\u0026nbsp;\u003cspan\u003eWhen converting a compound datatype containing floating-point members during a dataset read\u003c/span\u003e\u003cspan\u003e, a temporary buffer allocated with \u003c/span\u003e\u003ccode\u003ecalloc()\u003c/code\u003e\u003cspan\u003e is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 \u003c/span\u003e\u003cspan\u003efile containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as \u003c/span\u003e\u003ccode\u003eh5dump\u003c/code\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThis can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.\u003c/span\u003e\u003c/p\u003e"
                }
              ],
              "value": "A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2.\u00a0When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump.\u00a0This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "CWE-416 Use after free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-16T15:58:14.633Z",
            "orgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
            "shortName": "HDFG"
          },
          "references": [
            {
              "url": "https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Heap Use-After-Free in H5T__conv_f_f",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "0253b833-3e77-4dfe-9d57-17db1a2f0a74",
        "assignerShortName": "HDFG",
        "cveId": "CVE-2026-92627",
        "datePublished": "2026-09-16T15:16:54.160Z",
        "dateReserved": "2026-09-16T15:14:38.985Z",
        "dateUpdated": "2026-09-16T15:58:14.633Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.