CVE-2025-57109

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-57117.3A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. Affected is an unk CVE-2025-571175.4A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScri CVE-2025-571189.8An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php CVE-2025-571199.8An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login CVE-2025-57127.3A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulne CVE-2025-57135.4A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250519 and classified as problematic. Affected by this issue is some unknown CVE-2025-571308.8An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker CVE-2025-57144.3A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part o CVE-2025-571409.8rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.CVE-2025-571419.8rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.CVE-2025-571455.4A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails t CVE-2025-571468.1phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.