CVE-2025-57108

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-571096.5Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files CVE-2025-57117.3A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unk CVE-2025-571175.4A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScri CVE-2025-571189.8An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php CVE-2025-571199.8An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login CVE-2025-57127.3A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulne CVE-2025-57135.4A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown CVE-2025-571308.8An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker CVE-2025-57144.3A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part o CVE-2025-571409.8rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.CVE-2025-571419.8rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.CVE-2025-571455.4A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails t