{"id":"CVE-2026-42057","kind":"vulnerability","aliases":["CVE-2026-42057"],"related":[],"title":"VTK: crafted PNG file causes invalid pointer dereference and crash","description":"An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.","summary":"VTK 9.6's PNG reader dereferences an invalid pointer when it processes a specially crafted .png file. An attacker who supplies such a file can crash the application, a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vtk","fixed":[],"affected":"9.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["c++","package","python","vtk"],"not_affected_if":["no-untrusted-png-input"],"how_to_check":"- Check the installed VTK version, for example `vtkVersion` or the package manager's listing, and see whether it is `9.6`.\n- Find code that opens PNG files with vtkPNGReader on untrusted input.","fix":null,"status":"open","published_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","triaged_at":"2026-10-29T19:27:20+00:00","updated_at":"2026-10-29T19:29:27+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T19:27:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"VTK: crafted PNG file causes invalid pointer dereference and crash","impact":"low","summary":"VTK 9.6's PNG reader dereferences an invalid pointer when it processes a specially crafted .png file. An attacker who supplies such a file can crash the application, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["vtk","python","c++"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes while processing a malicious PNG file","analyst_note":"Check the NVD entry and the VTK project's advisories for a fixed version and whether a patch exists; the sources here do not state either.","how_to_check":"- Check the installed VTK version, for example `vtkVersion` or the package manager's listing, and see whether it is `9.6`.\n- Find code that opens PNG files with vtkPNGReader on untrusted input.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-png-input"],"who_is_affected":"Applications built on VTK 9.6 that read PNG files supplied by users or other untrusted sources are exposed. Programs that only read PNG files the team created itself are unlikely to be reached by an attacker.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":4138,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the VTK project's advisories for a fixed version and whether a patch exists; the sources here do not state either.","search":"'-2026':12A,15A '-42057':13A,16A '9.6':23B,67C 'applic':49B 'attack':40B,81C 'c':18B 'caus':5A 'craft':2A,36B,70C 'crash':10A,47B 'cve':11A,14A 'denial':51B,77C 'derefer':8A,27B,57C 'exist':59C 'file':4A,38B,45B,72C,86C 'function':64C 'invalid':6A,29B,55C 'lead':74C 'malici':85C 'packag':19B 'png':3A,25B,37B,71C 'pointer':7A,30B,56C 'process':33B 'provid':83C 'python':20B 'reader':26B 'servic':53B,79C 'special':35B,69C 'suppli':42B 'trigger':88C 'vtk':1A,17A,21B,22B,66C 'vtkpngreader':62C 'vtkpngreaderupdate2':63C 'vulner':58C,90C","nicknames":[],"mitigations":[],"who_affected":"Applications built on VTK 9.6 that read PNG files supplied by users or other untrusted sources are exposed. Programs that only read PNG files the team created itself are unlikely to be reached by an attacker.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42057","severity":null,"published_at":"2026-10-29T19:17:21+00:00","modified_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","fetched_at":"2026-10-29T19:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42057:1101","url":null,"severity":null,"published_at":"2026-10-29T19:29:27+00:00","modified_at":"2026-10-29T19:29:27+00:00","first_seen_at":"2026-10-29T19:29:27+00:00","fetched_at":"2026-10-29T19:29:27+00:00","note":"CVE assigned by Talos CNA (CVSS 7.5, AV:N/PR:N, DoS only). Only the NVD entry was found; no Talos report, Kitware advisory or fix commit located, so fixed version is unknown and nothing marked verified. Affected list per NVD is 'vtk 9.6' (sibling Talos VTK CVEs cite 9.6.1). Sibling CVE-2026-41216 (also vtkPNGReader invalid pointer) likely related. Settle by finding the TALOS-2026-xxxx report or the VTK gitlab fix MR. No exploitation or PoC seen."}],"documents":[{"id":18904,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42057","title":"NVD CVE-2026-42057","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}