CVE-2025-57107

HighCVSS 7.1/10Last modified Nov 5, 2026

Description

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.kitware.com/vtk/vtk/-/issues/19732Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Oct 31, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-571089.8Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability m CVE-2025-571096.5Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files CVE-2025-57117.3A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unk CVE-2025-571175.4A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScri CVE-2025-571189.8An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php CVE-2025-571199.8An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login CVE-2025-57127.3A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulne CVE-2025-57135.4A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown CVE-2025-571308.8An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker CVE-2025-57144.3A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part o CVE-2025-571409.8rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.CVE-2025-571419.8rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.