{"id":"CVE-2026-118589","kind":"vulnerability","aliases":["CVE-2026-118589"],"related":[],"title":"meshio: crafted VTK file triggers uncontrolled memory allocation","description":"A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.","summary":"meshio, a Python library for reading and writing mesh files, has a flaw in its VTK reader where the DIMENSIONS value is not bounded before memory is allocated. A remote attacker who gets a crafted VTK file parsed can exhaust memory and crash the reading process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meshio","package","python","scientific-computing"],"not_affected_if":["trusted-input-only","vtk-reader-unused"],"how_to_check":"- Run `pip show meshio` and compare the version to the affected range (up to `5.3.5`).\n- Search code for calls to `meshio.read` on VTK files from untrusted sources.","fix":"- Upgrade meshio past `5.3.5` once a fixed release is published; the sources say the maintainers have not yet responded, so check the project for a patch.\n- Until fixed, only parse VTK files from trusted sources or validate file headers before reading.","status":"open","published_at":"2026-10-29T00:17:26+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","triaged_at":"2026-10-29T00:37:14+00:00","updated_at":"2026-10-29T00:37:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T00:37:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade meshio past `5.3.5` once a fixed release is published; the sources say the maintainers have not yet responded, so check the project for a patch.\n- Until fixed, only parse VTK files from trusted sources or validate file headers before reading.","reach":"internet","title":"meshio: crafted VTK file triggers uncontrolled memory allocation","impact":"low","summary":"meshio, a Python library for reading and writing mesh files, has a flaw in its VTK reader where the DIMENSIONS value is not bounded before memory is allocated. A remote attacker who gets a crafted VTK file parsed can exhaust memory and crash the reading process.","category":"package","nicknames":[],"who_cares":["python","meshio","scientific-computing"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted file exhausts memory and crashes the process reading it","analyst_note":"Confirm the fixed version and whether the maintainers responded; the NVD entry gives no patch version.","how_to_check":"- Run `pip show meshio` and compare the version to the affected range (up to `5.3.5`).\n- Search code for calls to `meshio.read` on VTK files from untrusted sources.","needs_analyst":true,"not_affected_if":["trusted-input-only","vtk-reader-unused"],"who_is_affected":"Services or pipelines that call meshio's VTK reader on files supplied from outside the team, such as user uploads or external data feeds, are exposed. Teams that only read their own generated mesh files, or do not use the VTK reader, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000623,"input_tokens":3334,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118589':11A,14A '-2026':10A,13A '5.3.5':77C 'alloc':8A,48B,104C 'argument':97C 'attack':51B,106C 'bound':44B 'compon':89C 'comput':20B 'craft':2A,55B 'crash':63B 'cve':9A,12A 'dimens':40B,98C 'earli':118C 'execut':92C,109C 'exhaust':60B 'file':4A,30B,57B,85C 'flaw':33B 'function':82C 'get':53B 'identifi':71C 'impact':78C 'inform':114C 'issu':121C 'lead':100C 'librari':24B 'manipul':94C 'memori':7A,46B,61B,103C 'mesh':29B 'meshio':1A,15B,21B,74C 'meshio/_vtk_42.py':86C 'nschloe':73C 'packag':16B 'pars':58B 'problem':117C 'process':66B 'project':112C 'python':17B,23B 'read':26B,65B 'reader':37B,91C 'remot':50B,110C 'report':122C 'respond':126C 'scientif':19B 'scientific-comput':18B 'trigger':5A 'uncontrol':6A,102C 'unknown':81C 'valu':41B 'vtk':3A,36B,56B,90C 'weak':68C 'write':28B 'yet':127C","nicknames":[],"mitigations":[],"who_affected":"Services or pipelines that call meshio's VTK reader on files supplied from outside the team, such as user uploads or external data feeds, are exposed. Teams that only read their own generated mesh files, or do not use the VTK reader, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-29T00:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118589","severity":null,"published_at":"2026-10-29T00:17:26+00:00","modified_at":"2026-10-29T00:17:26+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","fetched_at":"2026-10-29T00:36:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}