CVE-2026-92627 Overview
CVE-2026-92627 is a heap use-after-free vulnerability in the Hierarchical Data Format version 5 (HDF5) library. The flaw resides in the H5T__conv_f_f() function in src/H5Tconv.c and affects HDF5 releases before 1.14.2. During conversion of a compound datatype containing floating-point members on a dataset read, a temporary buffer allocated with calloc() is freed and then re-read inside the same conversion routine. An attacker who supplies a crafted HDF5 file can trigger the use-after-free when a consuming application, such as h5dump, parses the affected dataset. The condition is classified under CWE-416.
Critical Impact
Parsing a malicious HDF5 file can crash the consuming process and, depending on heap layout, may allow memory corruption leading to arbitrary code execution in the context of the parsing application.
Affected Products
- HDF5 library versions prior to 1.14.2
- Applications linking HDF5, including h5dump and other HDF5 command-line tools
- Downstream scientific and data analysis tools that consume HDF5 datasets containing compound datatypes
Discovery Timeline
- 2026-09-16 - CVE-2026-92627 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92627
Vulnerability Analysis
HDF5 uses H5T__conv_f_f() to convert floating-point data between representations during read and write operations. When the source dataset is a compound datatype containing floating-point members, the routine allocates a temporary heap buffer with calloc() to stage conversion state. The function releases this buffer through free() before all references to it are retired. A subsequent read within the same conversion loop dereferences the stale pointer, producing a classic heap use-after-free.
The vulnerability activates on the read path. Any application that opens a hostile HDF5 file and iterates the affected dataset is exposed, including standard tooling such as h5dump. Scientific pipelines that ingest partner or third-party HDF5 files are particularly relevant attack surfaces.
Root Cause
The root cause is incorrect lifetime management of a temporary conversion buffer inside H5T__conv_f_f(). The buffer is freed while later code paths in the same function still hold and use the pointer. Compound datatypes trigger the vulnerable path because their member-by-member conversion loop reuses the temporary allocation across iterations.
Attack Vector
Exploitation requires the target application to open an attacker-supplied HDF5 file and read a dataset built with a crafted compound datatype. Delivery vectors include email attachments, shared research data, artifact repositories, and automated ingestion pipelines. The immediate outcome is a process crash. If the freed chunk is reallocated with attacker-controlled contents before the stale read, controlled memory corruption becomes possible, and code execution may follow in the context of the parsing user.
No verified public exploit code is available. Refer to the Pulse Security Advisory for the vendor-independent technical writeup.
Detection Methods for CVE-2026-92627
Indicators of Compromise
- Crashes, segmentation faults, or AddressSanitizer heap-use-after-free reports originating from H5T__conv_f_f in libhdf5
- HDF5 files received from untrusted sources that define compound datatypes with floating-point members
- Unexpected termination of h5dump, h5ls, or downstream analytics processes when reading external .h5 or .hdf5 files
Detection Strategies
- Run HDF5 tools and consumers under AddressSanitizer or Valgrind in staging to surface use-after-free conditions during ingestion tests
- Inventory HDF5 library versions across workstations, HPC clusters, and container images to identify hosts running versions earlier than 1.14.2
- Alert on process crashes involving HDF5 binaries or applications linked against libhdf5 in EDR telemetry
Monitoring Recommendations
- Log and review file provenance for HDF5 datasets processed by automated pipelines
- Monitor scientific compute nodes for repeated abnormal termination of parsing jobs, which may indicate exploitation attempts
- Track outbound network activity from data-processing hosts after HDF5 ingestion to detect post-exploitation behavior
How to Mitigate CVE-2026-92627
Immediate Actions Required
- Upgrade HDF5 to version 1.14.2 or later across all systems, containers, and bundled distributions
- Rebuild and redeploy applications that statically link libhdf5 against the patched version
- Restrict processing of HDF5 files sourced from untrusted parties until patched libraries are in place
Patch Information
The HDF Group addressed the use-after-free in HDF5 1.14.2. Consumers should update the shared library or vendored copy of HDF5 and verify the version reported by h5cc -showconfig or H5get_libversion(). See the Pulse Security Advisory for advisory-level details.
Workarounds
- Sandbox HDF5 parsing in a low-privilege container or dedicated user account to limit blast radius
- Validate incoming HDF5 files by inspecting datatype metadata and rejecting compound datatypes from untrusted origins
- Disable or restrict use of h5dump and similar tools on user-supplied files until the library is patched
# Verify installed HDF5 version on Linux
ldconfig -p | grep libhdf5
h5cc -showconfig | grep -i version
# Example: pin a minimum patched version in a Python environment
pip install 'h5py>=3.11' --upgrade
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
