CVE-2025-57108

critical · 9.8

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.

9.8

CVSS

0.4%

EPSS (exploit prob.)

31st

EPSS percentile

2025-10-31

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
vtk	vtk	<= 9.5.0

Check a specific version with /api/v1/cve/match.

References

https://gitlab.kitware.com/vtk/vtk/-/issues/19736

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-57108