CVE-2026-9536
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A heap-based buffer overflow exists in the vtkWindBladeReader FindVariableOffsets functionality of VTK version 9.6.1. A specially crafted .wind file can trigger a buffer overflow.
Risk Assessment
An attacker can provide a malicious file to trigger the overflow, potentially leading to code execution or memory corruption. This affects applications processing VTK files.
Recommendation
Update VTK to a patched version or avoid processing untrusted .wind files.
Other vulnerabilities in VTK
See all- CVE-2026-9535High
An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of VTK version 9.6.1. A specially crafted chaco file can trigger an out-of-bounds read.
- CVE-2026-8824High
A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of VTK version 9.6.1. A specially crafted .bmp file can lead to a buffer overflow.
- CVE-2026-8822High
A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of VTK version 9.6.1. A specially crafted USGS DEM file can lead to a buffer overflow.
- CVE-2026-42057High
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.
- CVE-2026-41216High
An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of VTK 9.6. A specially crafted .png file can lead to a denial of service.
Original NVD description (English source)
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS