HDF Group HDF5 prior 2.3.0 src/H5Tconv.c H5T__conv_f_f use after free

Summaryinfo

A vulnerability categorized as critical has been discovered in HDF Group HDF5 prior 2.3.0. The affected element is the function H5T__conv_f_f of the file src/H5Tconv.c. Executing a manipulation can lead to use after free. The identification of this vulnerability is CVE-2026-92627. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in HDF Group HDF5 prior 2.3.0 and classified as critical. This vulnerability affects the function H5T__conv_f_f of the file src/H5Tconv.c. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 2.3.0. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.

The advisory is available at pulsesecurity.co.nz. This vulnerability was named CVE-2026-92627 since 09/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• HDF Group

Name

• HDF5

Version

• <2.3.0

License

• free

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion