---
id: "CVE-2026-42057"
kind: "vulnerability"
aliases: ["CVE-2026-42057"]
title: "VTK: crafted PNG file causes invalid pointer dereference and crash"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vtk", "fixed": [], "affected": "9.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c++", "package", "python", "vtk"]
not_affected_if: ["no-untrusted-png-input"]
published_at: "2026-10-29T19:17:21+00:00"
first_seen_at: "2026-10-29T19:26:48+00:00"
updated_at: "2026-10-29T19:29:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42057", "first_seen_at": "2026-10-29T19:26:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T19:29:27+00:00"}]
---

# VTK: crafted PNG file causes invalid pointer dereference and crash

VTK 9.6's PNG reader dereferences an invalid pointer when it processes a specially crafted .png file. An attacker who supplies such a file can crash the application, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vtk affected 9.6 fixed ?

## How to check

- Check the installed VTK version, for example `vtkVersion` or the package manager's listing, and see whether it is `9.6`.
- Find code that opens PNG files with vtkPNGReader on untrusted input.

## Timeline

- 2026-10-29T19:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42057
- 2026-10-29T19:29:27+00:00 analyst — CVE assigned by Talos CNA (CVSS 7.5, AV:N/PR:N, DoS only). Only the NVD entry was found; no Talos report, Kitware advisory or fix commit located, so fixed version is unknown and nothing marked verified. Affected list per NVD is 'vtk 9.6' (sibling Talos VTK CVEs cite 9.6.1). Sibling CVE-2026-41216 (also vtkPNGReader invalid pointer) likely related. Settle by finding the TALOS-2026-xxxx report or the VTK gitlab fix MR. No exploitation or PoC seen.

## Documents

- [advisory] NVD CVE-2026-42057 https://nvd.nist.gov/vuln/detail/CVE-2026-42057

## From the sources

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_