Live › vulnerability › CVE-2026-8822
VTK, the Visualization Toolkit library, has a memory corruption bug in its vtkDEMReader ReadProfiles code path for USGS DEM terrain files. A crafted DEM file can cause a buffer overflow, which an attacker can use to crash the process or possibly run code when a victim opens the file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that use VTK 9.6.1 (C++ or the Python vtk package) and load USGS DEM terrain files with vtkDEMReader. Exposure is highest when DEM files come from untrusted sources such as uploads or external data feeds. Anything that never reads DEM files, or only reads trusted local data, can skip it. Only 9.6.1 is named as affected; other versions are untested, not confirmed safe.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | pypi | 9.6.1 | – |
vtkVersion::GetVTKVersion() or the VTK package version in your build or lockfile, and look for 9.6.1.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-8822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.