An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6.
Affects vtk 9.6 when its PNG reader processes a specially crafted .png file. No vendor severity rating or fixed version is listed in the checked facts.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The Visualization Toolkit (VTK) library, specifically its PNG image reading component, is affected by this vulnerability. An attacker who supplies a maliciously crafted PNG file could cause the software to crash, resulting in a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- vtk vtk
9.6
References 2
talosintelligence.com
vtk.org
Questions about CVE-2026-42057
What does this mean?
A specially crafted .png file can cause the vtk PNG reader to dereference an invalid pointer. The result is a denial of service, because the application crashes.Source: talosintelligence.com
Am I affected, and how do I check?
The listed condition is vtk version 9.6. To check, look up the vtk version your application uses and see whether it is 9.6.Source: talosintelligence.com
What should I do about it?
The checked facts do not name a fixed version, so no upgrade target is given. Check the vtk project for a release that addresses this issue.Source: talosintelligence.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
Avoid opening untrusted .png files with the vtk PNG reader until a fix is available. This limits the chance of a crash from a crafted file.Source: talosintelligence.com