CVE-2026-118589

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118589", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-28T16:17:16.147Z", "datePublished": "2026-10-28T23:45:18.675Z", "dateUpdated": "2026-10-29T17:20:40.744Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-28T23:45:18.675Z"}, "title": "nschloe meshio VTK Reader _vtk_42.py memory allocation", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-789", "lang": "en", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}], "affected": [{"vendor": "nschloe", "product": "meshio", "versions": [{"version": "5.3.0", "status": "affected"}, {"version": "5.3.1", "status": "affected"}, {"version": "5.3.2", "status": "affected"}, {"version": "5.3.3", "status": "affected"}, {"version": "5.3.4", "status": "affected"}, {"version": "5.3.5", "status": "affected"}], "cpes": ["cpe:2.3:a:nschloe:meshio:*:*:*:*:*:*:*:*"], "modules": ["VTK Reader"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "timeline": [{"time": "2026-10-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-28T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-28T17:22:21.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Mohammedix88 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/428027", "name": "VDB-428027 | nschloe meshio VTK Reader _vtk_42.py memory allocation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/428027/cti", "name": "VDB-428027 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-118589", "name": "CVE-2026-118589 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026207", "name": "Submit #1026207 | nschloe meshio 5.3.5 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nschloe/meshio/issues/1576", "tags": ["issue-tracking"]}, {"url": "https://github.com/nschloe/meshio/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:43:42.543685Z", "id": "CVE-2026-118589", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:20:40.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:43:42.543685Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:43:43.664Z"}}], "cna": {"title": "nschloe meshio VTK Reader _vtk_42.py memory allocation", "credits": [{"lang": "en", "type": "reporter", "value": "Mohammedix88 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:nschloe:meshio:*:*:*:*:*:*:*:*"], "vendor": "nschloe", "modules": ["VTK Reader"], "product": "meshio", "versions": [{"status": "affected", "version": "5.3.0"}, {"status": "affected", "version": "5.3.1"}, {"status": "affected", "version": "5.3.2"}, {"status": "affected", "version": "5.3.3"}, {"status": "affected", "version": "5.3.4"}, {"status": "affected", "version": "5.3.5"}]}], "timeline": [{"lang": "en", "time": "2026-10-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-28T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-28T17:22:21.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/428027", "name": "VDB-428027 | nschloe meshio VTK Reader _vtk_42.py memory allocation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/428027/cti", "name": "VDB-428027 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-118589", "name": "CVE-2026-118589 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026207", "name": "Submit #1026207 | nschloe meshio 5.3.5 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nschloe/meshio/issues/1576", "tags": ["issue-tracking"]}, {"url": "https://github.com/nschloe/meshio/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-28T23:45:18.675Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118589", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:20:40.744Z", "dateReserved": "2026-10-28T16:17:16.147Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-28T23:45:18.675Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nschloe:meshio:*:*:*:*:*:*:*:*"], "modules": ["VTK Reader"], "product": "meshio", "vendor": "nschloe", "versions": [{"status": "affected", "version": "5.3.0"}, {"status": "affected", "version": "5.3.1"}, {"status": "affected", "version": "5.3.2"}, {"status": "affected", "version": "5.3.3"}, {"status": "affected", "version": "5.3.4"}, {"status": "affected", "version": "5.3.5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-118589", "lastModified": "2026-10-29T18:17:27.680", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118589", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:43:42.543685Z", "version": "2.0.3"}}]}, "published": "2026-10-29T00:17:26.320", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/nschloe/meshio/"}, {"source": "cna@vuldb.com", "url": "https://github.com/nschloe/meshio/issues/1576"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-118589"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1026207"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/428027"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/428027/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "meshio: meshio: Denial of Service via uncontrolled memory allocation in VTK reader", "id": "2563242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563242"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.", "A flaw was found in meshio. A remote attacker could trigger uncontrolled memory allocation by providing a specially crafted file with manipulated dimension values to the VTK reader component. This excessive memory consumption can lead to system resource exhaustion, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-118589", "public_date": "2026-10-28T23:45:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118589\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118589\nhttps://github.com/nschloe/meshio/\nhttps://github.com/nschloe/meshio/issues/1576\nhttps://vuldb.com/cve/CVE-2026-118589\nhttps://vuldb.com/submit/1026207\nhttps://vuldb.com/vuln/428027\nhttps://vuldb.com/vuln/428027/cti"], "statement": "This vulnerability is evaluated as having Low impact because successful exploitation relies on local user interaction to ingest an untrusted input file and is restricted to process memory exhaustion without affecting confidentiality or integrity. Furthermore, meshio is not shipped or supported in Red Hat Enterprise Linux, appearing only in community-driven Fedora distributions. When utilized in typical desktop or analytical environments, the tool runs as an ephemeral command-line script or imported helper, confining any crash or resource consumption strictly to the invoking user's session.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.3.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "meshio", "source": "cna", "vendor": "nschloe"}, "product": "meshio", "vendor": "nschloe"}], "created": "2026-10-29T01:30:09.549713+00:00", "updated": "2026-11-06T02:15:18.150595+00:00", "vendors": ["nschloe", "nschloe$PRODUCT$meshio"]}