CVE-2026-92627: Heap Use-After-Free in H5T__conv_f_f
A heap-use-after-free vulnerability exists in H5Tconvff() in src/H5Tconv.c in HDF5 before 2.3.0. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HDF5to a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Applications using HDF5 versions before 2.3.0 are exposed when they read an attacker-supplied HDF5 dataset that uses a specially constructed compound datatype with floating-point members. The affected read path can be reached by tools such as h5dump.
What does an attacker need to trigger the vulnerability?
An attacker needs to provide a crafted HDF5 file containing the required compound datatype and cause an affected application to read the relevant dataset. No network-facing service requirement is stated; exposure depends on processing untrusted HDF5 files.
What is the potential impact if the vulnerable path is reached?
The issue can cause an application crash. Depending on heap layout and allocator behavior, the use-after-free may also permit further memory corruption up to remote code execution.
What version boundary is identified as affected?
HDF5 versions before 2.3.0 are identified as affected. The provided information does not specify a workaround for environments that cannot immediately move to that version or later.