Heap Use-After-Free Vulnerability in HDF5 Software by HDF Group

CVE-2026-92627

What is CVE-2026-92627?

A heap-use-after-free vulnerability exists in the HDF5 library, specifically in the H5T__conv_f_f() function within src/H5Tconv.c. This issue affects versions prior to 1.14.2. It allows attackers who can deliver a crafted HDF5 file with a specially constructed compound datatype to trigger this vulnerability during the dataset reading process. The flaw arises when a temporary buffer, allocated using calloc(), is freed and then accessed, leading to a potential crash of the application. Additionally, depending on the situation of the heap and the behavior of the memory allocator, this vulnerability may facilitate memory corruption risks that could be exploited for further malicious actions, including remote code execution.

References