CVE-2026-41216: High severity vulnerability
An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Applications using vtk 9.6 that process PNG files through vtkPNGReader::ExecuteInformation are exposed. An attacker can target any workflow that accepts or opens attacker-supplied PNG files.
What does an attacker need to exploit it?
The attacker needs to provide a specially crafted PNG file for the affected VTK functionality to process. The supplied severity vector indicates network reachability, low attack complexity, no privileges, and no user interaction.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through an invalid pointer dereference. The provided impact metrics indicate availability impact only, with no stated confidentiality or integrity impact.