{"id":"CVE-2026-9536","kind":"vulnerability","aliases":["CVE-2026-9536"],"related":[],"title":"VTK: crafted .wind file overflows heap in vtkWindBladeReader","description":"A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.","summary":"VTK, a scientific visualization library, has a heap buffer overflow in its vtkWindBladeReader FindVariableOffsets code path when reading a crafted .wind file. An attacker who gets a victim to open a malicious file can trigger memory corruption, which may allow code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vtk","fixed":[],"affected":"9.6.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["c++","file-parsing","package","scientific-computing","vtk"],"not_affected_if":["no-wind-files","trusted-input-only"],"how_to_check":"- Check the VTK version in use (vtkVersion::GetVTKVersion(), or pip show vtk / the installed package); 9.6.1 is the version named affected.\n- Search your code for vtkWindBladeReader or .wind inputs; if neither is used, you are not exposed.","fix":null,"status":"open","published_at":"2026-10-29T19:17:30+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","triaged_at":"2026-10-29T19:27:20+00:00","updated_at":"2026-10-29T19:28:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T19:27:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"VTK: crafted .wind file overflows heap in vtkWindBladeReader","impact":"high","summary":"VTK, a scientific visualization library, has a heap buffer overflow in its vtkWindBladeReader FindVariableOffsets code path when reading a crafted .wind file. An attacker who gets a victim to open a malicious file can trigger memory corruption, which may allow code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["vtk","scientific-computing","c++"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap corruption from a crafted file may allow code execution","analyst_note":"Confirm the fixed VTK version and whether the flaw is reachable through network-facing file handling, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9536.","how_to_check":"- Check whether the VTK version in use is `9.6.1`, for example with `vtkVersion::GetVTKVersion()` or the installed package version.\n- Check whether the application reads `.wind` files through the vtkWindBladeReader.","plain_action":"","needs_analyst":true,"not_affected_if":["no-wind-files","trusted-input-only"],"who_is_affected":"Applications that link VTK 9.6.1 and open .wind files supplied by users or untrusted sources are exposed. Programs that only process trusted local data, or do not read .wind files, can skip it. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4136,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed VTK version and whether the flaw is reachable through network-facing file handling, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9536.","search":"'-2026':10A,13A '-9536':11A,14A '9.6.1':84C 'allow':64B 'attack':48B,96C 'base':70C 'buffer':33B,71C,93C 'c':16B 'code':39B,65B 'comput':23B 'corrupt':61B 'craft':2A,44B,87C 'cve':9A,12A 'execut':66B 'exist':74C 'file':4A,18B,46B,57B,101C 'file-pars':17B 'findvariableoffset':38B,78C 'function':79C 'get':50B 'heap':6A,32B,69C 'heap-bas':68C 'lead':90C 'librari':29B 'malici':56B,100C 'may':63B 'memori':60B 'open':54B 'overflow':5A,34B,72C,94C 'packag':20B 'pars':19B 'path':40B 'provid':98C 'read':42B 'scientif':22B,27B 'scientific-comput':21B 'special':86C 'trigger':59B,103C 'version':82C 'victim':52B 'visual':28B 'vtk':1A,15A,24B,25B,81C 'vtkwindbladeread':8A,37B,77C 'vulner':73C,105C 'wind':3A,45B,88C","nicknames":[],"mitigations":[],"who_affected":"Applications that link VTK 9.6.1 and open .wind (WindBlade) files from users or untrusted sources through vtkWindBladeReader are exposed. It is a file-parsing bug, so it only matters where an attacker can get a crafted file in front of the reader (upload pipelines, shared datasets, desktop visualization tools). Apps that do not use vtkWindBladeReader or only open trusted local data can skip it. No fixed version has been confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"talos-cna@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9536","severity":null,"published_at":"2026-10-29T19:17:30+00:00","modified_at":"2026-10-29T19:17:30+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","fetched_at":"2026-10-29T19:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9536:1097","url":null,"severity":null,"published_at":"2026-10-29T19:28:24+00:00","modified_at":"2026-10-29T19:28:24+00:00","first_seen_at":"2026-10-29T19:28:24+00:00","fetched_at":"2026-10-29T19:28:24+00:00","note":"No primary page readable: NVD page returned empty, no Talos report or Kitware advisory found yet (searched Talos, VTK docs, GitHub tags). CNA is Talos; only 9.6.1 is named affected. VTK 9.6.2 was tagged 2026-05-15, but I found no statement that it fixes this, so the fixed version is unknown. Nothing marked verified. The CVSS AV:N is the CNA's rating; the bug needs a victim app to open a crafted .wind file, so it is not a listening service. Revisit once the Talos report or a Kitware fix MR appears."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}