CVE-2026-118589
Description
A flaw was found in meshio. A remote attacker could trigger uncontrolled memory allocation by providing a specially crafted file with manipulated dimension values to the VTK reader component. This excessive memory consumption can lead to system resource exhaustion, resulting in a Denial of Service (DoS).
Statement
This vulnerability is evaluated as having Low impact because successful exploitation relies on local user interaction to ingest an untrusted input file and is restricted to process memory exhaustion without affecting confidentiality or integrity. Furthermore, meshio is not shipped or supported in Red Hat Enterprise Linux, appearing only in community-driven Fedora distributions. When utilized in typical desktop or analytical environments, the tool runs as an ephemeral command-line script or imported helper, confining any crash or resource consumption strictly to the invoking user's session.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
