CVE-2025-57107
CVE-2025-57107
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
vtk9 Debian:12
- Versions
- 9.1.0+really9.1.0+dfsg2-5
- 9.1.0+really9.1.0+dfsg2-5+deb12u1
- 9.1.0+really9.1.0+dfsg2-6
- 9.1.0+really9.1.0+dfsg2-7
- 9.1.0+really9.1.0+dfsg2-7.1
- 9.1.0+really9.1.0+dfsg2-8
- 9.2.6+dfsg1-1+exp1
- 9.2.6+dfsg1-1+exp2
- 9.3.0+dfsg1-1
- 9.3.0+dfsg1-1.1
- 9.3.0+dfsg1-1~exp1
- 9.3.0+dfsg1-1~exp2
- 9.3.0+dfsg1-1~exp3
- 9.3.0+dfsg1-1~exp4
- 9.3.0+dfsg1-2
- 9.3.0+dfsg1-3
- 9.3.0+dfsg1-3+hurd.1
- 9.3.0+dfsg1-4
- 9.3.0+dfsg1-4+m68k
- 9.3.0+dfsg1-4.1+hurd.1
- 9.3.0+dfsg1-5
- 9.3.0+dfsg1-6
- 9.3.0+dfsg1-7
- 9.5.2+dfsg1-1~exp1
- 9.5.2+dfsg2-1
- 9.5.2+dfsg2-1~exp1
- 9.5.2+dfsg2-1~exp2
- 9.5.2+dfsg2-1~exp3
- 9.5.2+dfsg2-1~exp4
- 9.5.2+dfsg2-2
- 9.5.2+dfsg2-3
- 9.5.2+dfsg2-4
- 9.5.2+dfsg3-1
- 9.5.2+dfsg3-2
- 9.5.2+dfsg3-3
- 9.5.2+dfsg3-4
- 9.5.2+dfsg3-5
- 9.5.2+dfsg3-6
- 9.5.2+dfsg3-7
- 9.5.2+dfsg3-8
- 9.5.2+dfsg4-1
- 9.5.2+dfsg4-2
- 9.5.2+dfsg4-3
- 9.5.2+dfsg4-4
- 9.5.2+dfsg4-5
- 9.6.2+dfsg1-1exp1
- 9.6.2+dfsg1-1exp2
- 9.6.2+dfsg1-1exp3
- 9.6.2+dfsg1-1exp4
- 9.6.2+dfsg1-1exp5
- 9.6.2+dfsg1-2
- 9.6.2+dfsg1-3
- 9.6.2+dfsg1-4
- 9.6.2+dfsg1-5
- 9.6.2+dfsg1-6
- 9.6.2+ds-1
- 9.6.2+ds-2
- 9.6.2+ds-2+test
- 9.6.2+ds-2+test1
- 9.6.2+ds-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk9 Debian:13
- Versions
- 9.3.0+dfsg1-4
- 9.3.0+dfsg1-4+m68k
- 9.3.0+dfsg1-4.1+hurd.1
- 9.3.0+dfsg1-5
- 9.3.0+dfsg1-6
- 9.3.0+dfsg1-7
- 9.5.2+dfsg1-1~exp1
- 9.5.2+dfsg2-1
- 9.5.2+dfsg2-1~exp1
- 9.5.2+dfsg2-1~exp2
- 9.5.2+dfsg2-1~exp3
- 9.5.2+dfsg2-1~exp4
- 9.5.2+dfsg2-2
- 9.5.2+dfsg2-3
- 9.5.2+dfsg2-4
- 9.5.2+dfsg3-1
- 9.5.2+dfsg3-2
- 9.5.2+dfsg3-3
- 9.5.2+dfsg3-4
- 9.5.2+dfsg3-5
- 9.5.2+dfsg3-6
- 9.5.2+dfsg3-7
- 9.5.2+dfsg3-8
- 9.5.2+dfsg4-1
- 9.5.2+dfsg4-2
- 9.5.2+dfsg4-3
- 9.5.2+dfsg4-4
- 9.5.2+dfsg4-5
- 9.6.2+dfsg1-1exp1
- 9.6.2+dfsg1-1exp2
- 9.6.2+dfsg1-1exp3
- 9.6.2+dfsg1-1exp4
- 9.6.2+dfsg1-1exp5
- 9.6.2+dfsg1-2
- 9.6.2+dfsg1-3
- 9.6.2+dfsg1-4
- 9.6.2+dfsg1-5
- 9.6.2+dfsg1-6
- 9.6.2+ds-1
- 9.6.2+ds-2
- 9.6.2+ds-2+test
- 9.6.2+ds-2+test1
- 9.6.2+ds-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk9 Debian:14
- Versions
- 9.3.0+dfsg1-4
- 9.3.0+dfsg1-4+m68k
- 9.3.0+dfsg1-4.1+hurd.1
- 9.3.0+dfsg1-5
- 9.3.0+dfsg1-6
- 9.3.0+dfsg1-7
- 9.5.2+dfsg1-1~exp1
- 9.5.2+dfsg2-1
- 9.5.2+dfsg2-1~exp1
- 9.5.2+dfsg2-1~exp2
- 9.5.2+dfsg2-1~exp3
- 9.5.2+dfsg2-1~exp4
- 9.5.2+dfsg2-2
- 9.5.2+dfsg2-3
- 9.5.2+dfsg2-4
- 9.5.2+dfsg3-1
- 9.5.2+dfsg3-2
- 9.5.2+dfsg3-3
- 9.5.2+dfsg3-4
- 9.5.2+dfsg3-5
- 9.5.2+dfsg3-6
- 9.5.2+dfsg3-7
- 9.5.2+dfsg3-8
- 9.5.2+dfsg4-1
- 9.5.2+dfsg4-2
- 9.5.2+dfsg4-3
- 9.5.2+dfsg4-4
- 9.5.2+dfsg4-5
- 9.6.2+dfsg1-1exp1
- 9.6.2+dfsg1-1exp2
- 9.6.2+dfsg1-1exp3
- 9.6.2+dfsg1-1exp4
- 9.6.2+dfsg1-1exp5
- 9.6.2+dfsg1-2
- 9.6.2+dfsg1-3
- 9.6.2+dfsg1-4
- 9.6.2+dfsg1-5
- 9.6.2+dfsg1-6
- Affected ranges
- ECOSYSTEM: < 9.6.2+ds-1
Update to 9.6.2+ds-1
vtk PyPI
- Versions
- 8.1.0
- 8.1.1
- 8.1.2
- 9.0.0
- 9.0.1
- 9.0.2
- 9.0.3
- 9.1.0
- 9.2.2
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.3.20230807rc0
- 9.4.0
- 9.4.1
- 9.4.2
- 9.5.0
- Affected ranges
- ECOSYSTEM: < 9.5.1
Update to 9.5.1
vtk Ubuntu:Pro:14.04:LTS
- Versions
- 5.8.0-14ubuntu1
- 5.8.0-14ubuntu3
- 5.8.0-14.1ubuntu2
- 5.8.0-14.1ubuntu3
- 5.8.0-14.1ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk Ubuntu:Pro:16.04:LTS
- Versions
- 5.10.1+dfsg-2
- 5.10.1+dfsg-2build3
- 5.10.1+dfsg-2.1build1
- 5.10.1+dfsg-2.1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published