Live › vulnerability › CVE-2026-8824
VTK, the Visualization Toolkit library, has a memory corruption flaw in its BMP image reader. A specially crafted .bmp file can overflow a buffer, and an attacker who supplies such a file can trigger it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that parse .bmp files from outside sources with vtkBMPReader in VTK 9.6.1, such as image pipelines, medical or scientific viewers and upload services. Other versions are not listed as affected, but that has not been tested. You can skip it if you only read trusted images or never use vtkBMPReader.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | pypi | 9.6.1 | – |
9.6.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-8824")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.