VTK out-of-bounds read flaw CVE-2026-9535 disclosed in vtkChacoReader
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- VTK (Visualization Toolkit)
- Product
- vtk
- First seen
Summary
A CVSS 8.2 out-of-bounds read in the vtkChacoReader InputGraph2 function of vtk 9.6.1 is described in a CVE listing relayed by TheHackerWire. The listing says a specially crafted Chaco file can trigger it, so an attacker could supply a malicious file.
If you use VTK (Visualization Toolkit)
Check whether vtk 9.6.1 is in your software and dependencies
Avoid opening untrusted Chaco files until a fix is applied
Watch the CVE-2026-9535 advisory and upgrade to a fixed vtk release when one is published
Avoid opening untrusted .wind files until a fix is applied
Watch the CVE-2026-9536 advisory and upgrade to a fixed vtk release when one is published
What the sources say 2
· Mastodon: “A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1).” Source
· Mastodon: “A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1).” Source