Live › vulnerability › CVE-2026-9536
VTK, a scientific visualization library, has a heap buffer overflow in its vtkWindBladeReader FindVariableOffsets code path when reading a crafted .wind file. An attacker who gets a victim to open a malicious file can trigger memory corruption, which may allow code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Applications that link VTK 9.6.1 and open .wind (WindBlade) files from users or untrusted sources through vtkWindBladeReader are exposed. It is a file-parsing bug, so it only matters where an attacker can get a crafted file in front of the reader (upload pipelines, shared datasets, desktop visualization tools). Apps that do not use vtkWindBladeReader or only open trusted local data can skip it. No fixed version has been confirmed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vtk | vendor | 9.6.1 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-9536")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.