High · 7.5 CVE-2026-41216 EUVD-2026-113326GHSA-3xgx-gqxq-wp6h

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .…

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by talos

Vendor: vtk Product: vtk Package: vtk Package: vtk9 Ecosystem: Debian Ecosystem: Ubuntu

Description

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
vtk	vtk	9.6	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	vtk9	No fix yet	—
Debian 13	vtk9	No fix yet	—
Debian 12	vtk9	No fix yet	—

Ubuntu