Description
Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
Affected products
vtk: vtk
References2
- gitlab.kitware.com/vtk/vtk/-/issues/19733 ExploitIssue TrackingThird Party Advisory
- gitlab.kitware.com/vtk/vtk/-/issues/19734 ExploitIssue TrackingThird Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 37 · as of 10 November 2026
- CWE
- CWE-122
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.