Live › vulnerability › CVE-2026-41216
VTK 9.6's vtkPNGReader::ExecuteInformation mishandles libpng errors: a setjmp is set in a helper that has already returned, so a malformed PNG makes the error path call fclose on a garbage pointer and crash the process. Talos rates it denial of service (CVSS 7.5); no patched VTK release has been published yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications built on VTK 9.6 (Python vtk, C++, ParaView-style tools) that read PNG files from users or other untrusted sources through vtkPNGReader. A malformed PNG crashes the process; services that accept uploaded images are the main concern. Systems that only read trusted local images, or don't use the PNG reader, can skip it. No fixed version is published yet.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | vendor | 9.6 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-41216")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.