Heap Use-After-Free in H5T__conv_f_f

Answer in brief

CVE-2026-92627 records a Unknown severity vulnerability in Heap Use-After-Free in H5T__conv_f_f. The current sources do not mark it as known exploited. The current feed maps The HDF Group/HDF5 (generic), The HDF Group/HDF5 (generic), The HDF Group/HDF5 (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 16, 2026Updated Sep 16, 2026Source checked Sep 16, 2026First seen by HOL Sep 16, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps The HDF Group/HDF5 (generic), The HDF Group/HDF5 (generic), The HDF Group/HDF5 (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
The HDF Group/HDF5generic	<= 2.3.0	Not reported
The HDF Group/HDF5generic	1.14.1	Not reported
The HDF Group/HDF5generic	< 1.14.2	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for The HDF Group/HDF5, The HDF Group/HDF5, The HDF Group/HDF5.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 16, 2026

Sources and claim methodology

Source referencepulsesecurity.co.nz

Upstream source description

A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.

Quoted source text, attributed separately from HOL analysis.