CVE-2026-118589: nschloe meshio VTK Reader _vtk_42.py memory allocation
A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/vtk42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the meshio VTK Reader in meshio versions up to 5.3.5 are potentially exposed when they process VTK input that an attacker can manipulate. The issue is in meshio/_vtk_42.py.
What does an attacker need to exploit this issue?
An attacker needs to supply or cause processing of a VTK file with a manipulated DIMENSIONS argument. The reported attack vector is network-based and requires no privileges or user interaction.
What is the impact of successful exploitation?
Manipulating DIMENSIONS can trigger uncontrolled memory allocation, resulting in an availability impact. The provided assessment indicates no confidentiality or integrity impact.
How can teams reduce risk if they cannot update immediately?
Avoid processing untrusted or attacker-controlled VTK files with the affected VTK Reader, particularly files whose DIMENSIONS value can be altered. No vendor response or remediation is reported in the available data.