CVE-2026-9535: High severity vulnerability
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems using vtk 9.6.1 that process Chaco graph files through the vtkChacoReader InputGraph2 functionality are exposed. Because exploitation requires only a malicious file, any workflow that accepts or opens untrusted Chaco files is particularly relevant.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted Chaco file that is processed by the affected functionality. No authentication or user interaction is required according to the provided vector.
What is the likely impact of successful exploitation?
Successful exploitation can cause an out-of-bounds read and may affect availability. The supplied severity vector also indicates low confidentiality impact, with no integrity impact.