CVE-2025-57109

MediumCVSS 6.5

Published: 30/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects previously freed during actor import operations.

Risk Assessment

The vulnerability could lead to application crash or potentially arbitrary code execution in the context of the process handling a malicious GLTF file. The risk affects systems processing untrusted GLTF files.

Recommendation

Update Kitware VTK to a patched version or avoid processing untrusted GLTF files until updated. Implement input file validation.

Other vulnerabilities in Kitware VTK

CVE-2025-57108Critical
Kitware VTK through version 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS