UBUNTU-CVE-2026-9535: High severity ubuntu/vtk9 vulnerability
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must provide a specially crafted Chaco file that is processed by vtkChacoReader's InputGraph2 functionality. The vulnerability can be triggered without authentication or user interaction.
Who is exposed?
Systems using the Ubuntu vtk9 package and processing attacker-supplied or otherwise untrusted Chaco files are exposed. The affected vtk version identified is 9.6.1.
What is the likely impact of successful exploitation?
Successful exploitation causes an out-of-bounds read. The published severity vector indicates low confidentiality impact and high availability impact, with no integrity impact.