{"id":"CVE-2026-92627","title":"A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc()…","summary":"A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc()…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-416","CWE-825"],"vendor":"The HDF Group","product":"HDF5","affected":["HDF5 < 1.14.2"],"published":"2026-09-16","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:34:36.657","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92627","references":[{"url":"https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption","label":"0253b833-3e77-4dfe-9d57-17db1a2f0a74"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92627.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92627"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92627"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92627"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535513"},{"url":"https://access.redhat.com/errata/RHSA-2026:61630"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00229,"epssPercentile":0.12217,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T17:36:04.378638Z"},"cvssSource":"cna","scores":{"cna":4.6,"vendor":4.4},"ingestedAt":"2026-09-16T15:58:38.765Z","patched":["hardened_images"],"slug":"CVE-2026-92627","body":"## Overview\n\nA heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenStack Platform 13 (Queens) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenStack Platform 13 (Queens) · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92627.json)\n- **RHSA-2026:61630** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61630)","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}