High · 7.5 CVE-2026-9536 EUVD-2026-113321GHSA-7643-hgrp-qw2p

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A…

Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by talos

Vendor: vtk Product: vtk Package: vtk Package: vtk9 Ecosystem: Debian Ecosystem: Ubuntu

Description

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Affected products

Vendor	Product	Affected	Fixed
vtk	vtk	9.6.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	vtk9	No fix yet	—
Debian 13	vtk9	No fix yet	—
Debian 12	vtk9	No fix yet	—

Ubuntu