High · 7.5 CVE-2026-8824 EUVD-2026-113323GHSA-4rfj-w3wg-f3pw

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A special…

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by talos

Vendor: vtk Product: vtk Package: vtk Package: vtk9 Ecosystem: Debian Ecosystem: Ubuntu

Description

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
vtk	vtk	9.6.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	vtk9	No fix yet	—
Debian 13	vtk9	No fix yet	—
Debian 12	vtk9	No fix yet	—

Ubuntu