Live › vulnerability › CVE-2026-42057
VTK 9.6's PNG reader dereferences an invalid pointer when it processes a specially crafted .png file. An attacker who supplies such a file can crash the application, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications built on VTK 9.6 that read PNG files supplied by users or other untrusted sources are exposed. Programs that only read PNG files the team created itself are unlikely to be reached by an attacker.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | vendor | 9.6 | – |
vtkVersion or the package manager's listing, and see whether it is 9.6.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-42057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.