CVE-2026-42057
Description
A flaw was found in VTK. An attacker can cause a Denial of Service (DoS) by supplying a specially crafted PNG image file. When processed by the PNG reader component, the malformed input triggers an invalid pointer dereference, causing the application to crash.
Statement
Red Hat has evaluated this vulnerability as having Moderate severity because triggering the issue requires user interaction to load an untrusted graphic into an application linked against VTK, restricting the impact to process termination. The affected library is not distributed or supported within Red Hat Enterprise Linux core repositories, limiting its presence primarily to community packages in EPEL. Furthermore, the flaw only compromises availability of the local processing task and cannot be leveraged for data modification or arbitrary code execution.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the uninitialized pointer is used in a read operation, it might not point to a valid memory location. An attacker might be able to read sensitive portions of memory.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the uninitialized pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the uninitialized pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
