CVE-2026-92627

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 1.14.2

Description A heap-use-after-free issue exists in the H5T conv f f() function within src/H5Tconv.c. This occurs during the conversion of a compound datatype containing floating-point members during a dataset read, where a temporary buffer allocated with calloc() is freed and then accessed again within the same routine. A remote attacker can trigger this by providing a crafted HDF5 file with a specially constructed compound datatype to an application that reads the dataset, such as h5dump. This may lead to a crash or memory corruption, potentially allowing remote code execution.

Recommendations Update to version 1.14.2 or later.