PT-2025-44637 · Kitware+1 · Vtk+1

Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-57108

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kitware VTK (Visualization Toolkit) versions through 9.5.0

Description The software contains a heap use-after-free issue in vtkGLTFDocumentLoader. This occurs during mesh object copy operations, where vector members are accessed after the memory has been freed. The issue is triggered when processing GLTF files containing corrupted or invalid mesh reference structures.

Recommendations Versions prior to 9.5.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-57108

PYSEC-2025-226

Affected Products

Debian

Vtk

References · 12

• 🔥 https://gitlab.kitware.com/vtk/vtk/-/issues/19736 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-57108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57108 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-226 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-57108 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57108 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-57108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-57108 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-57108 · Vendor Advisory
• https://t.me/CVEtracker/36306 · Telegram Post
• https://twitter.com/CVEnew/status/1984312788077199709 · Twitter Post
• https://t.me/cveNotify/141148 · Telegram Post