CVE-2025-57108: Use After Free
Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57108?
CVE-2025-57108 is classified as a medium severity vulnerability in Kitware VTK.
How do I fix CVE-2025-57108?
To fix CVE-2025-57108, users should upgrade to the latest version of Kitware VTK that is higher than 9.5.0.
Which versions of Kitware VTK are affected by CVE-2025-57108?
CVE-2025-57108 affects Kitware VTK version 9.5.0 and earlier.
What type of vulnerability is CVE-2025-57108?
CVE-2025-57108 is a heap use-after-free vulnerability occurring during mesh object copy operations.
What can be exploited through CVE-2025-57108?
CVE-2025-57108 can be exploited when accessing vector members of a mesh after the memory has been freed, especially when handling GLTF files.