CVE-2026-42057

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42057", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2026-04-28T15:00:19.062Z", "datePublished": "2026-10-29T18:16:42.702Z", "dateUpdated": "2026-10-30T17:22:15.940Z"}, "containers": {"cna": {"affected": [{"vendor": "vtk", "product": "vtk", "versions": [{"status": "affected", "version": "9.6"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-825: Expired Pointer Dereference", "type": "CWE", "cweId": "CWE-825"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2026-10-29T18:16:42.702Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413"}, {"url": "https://vtk.org/download/", "name": "https://vtk.org/download/"}], "credits": [{"lang": "en", "value": "Discovered by Emmanuel Tacheau of Cisco Talos"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T17:22:02.474070Z", "id": "CVE-2026-42057", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:22:15.940Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"credits": [{"lang": "en", "value": "Discovered by Emmanuel Tacheau of Cisco Talos"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "vtk", "product": "vtk", "versions": [{"status": "affected", "version": "9.6"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413"}, {"url": "https://vtk.org/download/", "name": "https://vtk.org/download/"}], "descriptions": [{"lang": "en", "value": "An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-825", "description": "CWE-825: Expired Pointer Dereference"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2026-10-29T18:16:42.702Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:22:02.474070Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-30T17:22:10.597Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-42057", "state": "PUBLISHED", "dateUpdated": "2026-10-29T18:16:42.702Z", "dateReserved": "2026-04-28T15:00:19.062Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2026-10-29T18:16:42.702Z", "assignerShortName": "talos"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "vtk", "vendor": "vtk", "versions": [{"status": "affected", "version": "9.6"}]}], "source": "talos-cna@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability."}], "id": "CVE-2026-42057", "lastModified": "2026-10-30T18:17:30.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "talos-cna@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42057", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T17:22:02.474070Z", "version": "2.0.3"}}]}, "published": "2026-10-29T19:17:21.837", "references": [{"source": "talos-cna@cisco.com", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413"}, {"source": "talos-cna@cisco.com", "url": "https://vtk.org/download/"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-825"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vtk: vtk: Denial of Service via crafted PNG file", "id": "2563623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563623"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.", "A flaw was found in VTK. An attacker can cause a Denial of Service (DoS) by supplying a specially crafted PNG image file. When processed by the PNG reader component, the malformed input triggers an invalid pointer dereference, causing the application to crash."], "name": "CVE-2026-42057", "public_date": "2026-10-29T18:16:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42057\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42057\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2026-2413\nhttps://vtk.org/download/"], "statement": "Red Hat has evaluated this vulnerability as having Moderate severity because triggering the issue requires user interaction to load an untrusted graphic into an application linked against VTK, restricting the impact to process termination. The affected library is not distributed or supported within Red Hat Enterprise Linux core repositories, limiting its presence primarily to community packages in EPEL. Furthermore, the flaw only compromises availability of the local processing task and cannot be leveraged for data modification or arbitrary code execution.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vtk", "source": "cna", "vendor": "vtk"}, "product": "vtk", "vendor": "vtk"}], "created": "2026-10-29T20:00:29.067032+00:00", "updated": "2026-11-04T14:30:15.632435+00:00", "vendors": ["vtk", "vtk$PRODUCT$vtk"]}