---
id: "CVE-2026-118589"
kind: "vulnerability"
aliases: ["CVE-2026-118589"]
title: "meshio: crafted VTK file triggers uncontrolled memory allocation"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["meshio", "package", "python", "scientific-computing"]
not_affected_if: ["trusted-input-only", "vtk-reader-unused"]
published_at: "2026-10-29T00:17:26+00:00"
first_seen_at: "2026-10-29T00:36:21+00:00"
updated_at: "2026-10-29T00:37:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118589", "first_seen_at": "2026-10-29T00:36:21+00:00"}]
---

# meshio: crafted VTK file triggers uncontrolled memory allocation

meshio, a Python library for reading and writing mesh files, has a flaw in its VTK reader where the DIMENSIONS value is not bounded before memory is allocated. A remote attacker who gets a crafted VTK file parsed can exhaust memory and crash the reading process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show meshio` and compare the version to the affected range (up to `5.3.5`).
- Search code for calls to `meshio.read` on VTK files from untrusted sources.

## Fix

- Upgrade meshio past `5.3.5` once a fixed release is published; the sources say the maintainers have not yet responded, so check the project for a patch.
- Until fixed, only parse VTK files from trusted sources or validate file headers before reading.

## Timeline

- 2026-10-29T00:36:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118589

## From the sources

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_