CVE-2026-92627 The HDF Group CVE debrief

Who should care

Defenders responsible for systems that read HDF5 datasets, particularly those in scientific or data-intensive environments, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and apply patches or mitigations. Additionally, defenders should monitor for crafted HDF5 files and review compensating controls for

Why it matters

CVE-2026-92627 is a heap-use-after-free vulnerability in HDF5 before 1.14.2. Defenders should prioritize verifying and applying patches, assessing exposure in systems reading HDF5 datasets, and monitoring for crafted files. The vulnerability's scope and remediation require verification from official sources.

• Potential crash of applications reading affected datasets
• Possible memory corruption requiring further exploitation
• Need for verification of affected versions and scope
• Priority for patching and inventory checks

Technical summary

The vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. This can lead to a crash and potential memory corruption. The vulnerability requires verification of affected versions and scope, and defenders should prioritize patching and inventory checks for systems reading HDF5 datasets. Official sources provide details on affected versions and remediation steps.

Defensive priority

Defenders should prioritize verifying and applying patches for HDF5 versions prior to 1.14.2, and assess exposure in systems that read HDF5 datasets.

Recommended defensive actions

• Verify and apply patches for HDF5 versions prior to 1.14.2
• Assess exposure in systems that read HDF5 datasets
• Monitor for crafted HDF5 files containing specially constructed compound datatypes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope and remediation require verification from official sources. The vulnerability's impact and affected versions need further assessment. Official sources indicate a heap-use-after-free vulnerability in HDF5 before 1.14.2. Limited information is available on exploitation in the wild or specific attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.