HDF5 CVE-2026-92627

Q: What is the CVSS score of CVE-2026-92627?

CVE-2026-92627 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80836 MEDIUM

Use After Free (CWE-416)

2026-09-16 HDFG

GHSA-q9w4-8jx2-6xc8

RCE Buffer Overflow Use After Free Memory Corruption Hdf5

4.6

CVSS 4.0 · Vendor: HDFG

Severity by source

Vendor (HDFG) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local crafted-file parsing needs no privileges but requires the victim to open the file (UI:R); realistic impact is a crash plus marginal heap read, hence C:L/I:N/A:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (HDFG).

CVSS VectorVendor: HDFG

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 17:03 vuln.today

CVE Published

Sep 16, 2026 - 15:16 cve.org

MEDIUM 4.6

DescriptionCVE.org

A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 2.3.0. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the same conversion routine. An attacker who can supply a crafted HDF5 file containing a specially constructed compound datatype can trigger the use-after-free when the file is parsed by an application that reads the affected dataset, such as h5dump. This can result in a crash and, depending on heap layout and allocator behavior, may be exploitable for further memory corruption up to remote code execution.

AnalysisAI

Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to supply a crafted HDF5 file whose compound datatype contains floating-point members, and requires a victim to parse/read the affected dataset with an HDF5-consuming application (the advisory names h5dump; any tool linking libhdf5 before 2.3.0 qualifies). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely modest-priority issue and the vendor's own CVSS 4.0 base of 4.6 (Medium-Low) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to HDF5 2.3.0 or later as the primary fix, since the affected range is stated as everything before 2.3.0, and confirm the exact boundary against the vendor release notes and the Pulse Security advisory at https://pulsesecurity.co.nz/advisories/hdf5-memory-corruption given that EUVD lists 2.3.0 itself as affected; rebuild or relink every application and shared library that statically or dynamically embeds libhdf5, not just the CLI tools. … Detailed patch versions, workarounds, and compensating controls in full report.