---
id: "CVE-2026-41216"
kind: "vulnerability"
aliases: ["CVE-2026-41216"]
title: "VTK: crafted PNG file causes invalid pointer dereference and denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vtk", "fixed": [], "affected": "9.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["package", "python", "scientific-computing", "vtk", "vtk-9.6"]
not_affected_if: ["no-png-reader-use", "trusted-input-only"]
published_at: "2026-10-29T19:17:21+00:00"
first_seen_at: "2026-10-29T19:26:48+00:00"
updated_at: "2026-10-29T19:29:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41216", "first_seen_at": "2026-10-29T19:26:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T19:29:35+00:00"}]
---

# VTK: crafted PNG file causes invalid pointer dereference and denial of service

VTK 9.6's vtkPNGReader::ExecuteInformation mishandles libpng errors: a setjmp is set in a helper that has already returned, so a malformed PNG makes the error path call fclose on a garbage pointer and crash the process. Talos rates it denial of service (CVSS 7.5); no patched VTK release has been published yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vtk affected 9.6 fixed ?

## How to check

- Check the VTK version: python -c "import vtk; print(vtk.VTK_VERSION)" (or your C++ build / package manager). Only 9.6 is confirmed vulnerable; earlier versions were not reported as tested.
- Check whether your code opens PNGs from untrusted sources with vtkPNGReader (including via vtkImageReader2 factory / UpdateInformation).

## Timeline

- 2026-10-29T19:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-41216
- 2026-10-29T19:29:35+00:00 analyst — Read Talos TALOS-2026-2412 (discoverer, not vendor): vtk 9.6 only confirmed; vendor still 'dev team working' at 2026-10-12, no patched version published. Root cause: setjmp in HandleLibPngError returns into dead stack frame, so fclose(fp) on garbage when libpng errors (malformed PNG) in ExecuteInformation; Talos notes possible code-exec theory on old glibc, but rated DoS. Sibling CVE-2026-42057 (vtkPNGReaderUpdate2) same day. Fix unknown; check vtk.org/download and VTK GitLab.

## Documents

- [advisory] TALOS-2026-2412 vtk vtkPNGReader::ExecuteInformation invalid pointer dereference https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2412

## From the sources

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_