Invalid Pointer Dereference in VTK Software from Kitware
CVE-2026-42057

7.5HIGH

Key Information:

Vendor

Vtk

Status
Vtk
Vendor
CVE Published:
29 October 2026

What is CVE-2026-42057?

An invalid pointer dereference vulnerability in the VTK software can be exploited through specially crafted PNG files, potentially leading to a denial of service. Attackers might utilize maliciously designed images to trigger this issue, putting systems using VTK 9.6 at risk. Users are advised to update their software to the latest version and to implement security measures to mitigate any potential exploitation.

Affected Version(s)

vtk 9.6

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://vtk.org/download/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Emmanuel Tacheau of Cisco Talos
.