Live › vulnerability › CVE-2026-9535
The Visualization Toolkit (VTK) 9.6.1 has an out-of-bounds read in its vtkChacoReader InputGraph2 code path. A specially crafted Chaco graph file can make the reader read memory outside its buffer, and an attacker can exploit this by supplying a malicious file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Teams that build or run software on VTK 9.6.1 and pass it Chaco graph files from outside their control. Applications that never read Chaco files, or only read files they generated, are less exposed. The sources do not say whether a default build includes this reader.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | vendor | 9.6.1 | – |
vtkVersion in your build or the package manager listing, and look for 9.6.1.vtkChacoReader or InputGraph2 reading untrusted Chaco files.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-9535")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.