Live › vulnerability › CVE-2026-118589
Go to dashboardmeshio, a Python library for reading and writing mesh files, has a flaw in its VTK reader where the DIMENSIONS value is not bounded before memory is allocated. A remote attacker who gets a crafted VTK file parsed can exhaust memory and crash the reading process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 00:36 UTC. All times on this page are UTC.
Services or pipelines that call meshio's VTK reader on files supplied from outside the team, such as user uploads or external data feeds, are exposed. Teams that only read their own generated mesh files, or do not use the VTK reader, can skip it.
No product ranges from the sources yet.
pip show meshio and compare the version to the affected range (up to 5.3.5).meshio.read on VTK files from untrusted sources.5.3.5 once a fixed release is published; the sources say the maintainers have not yet responded, so check the project for a patch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-118589")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.