Vulnerability · Published Oct 31, 2025 · Assigned by mitre
CVE-2025-57108
Critical 9.8
In plain English
A critical-severity use-after-free in the vtk9 package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | vtk9 | no fix listed | DEBIAN-CVE-2025-57108 |
| Debian:13 | vtk9 | no fix listed | DEBIAN-CVE-2025-57108 |
| Debian:14 | vtk9 | 9.6.2+ds-1 | DEBIAN-CVE-2025-57108 |
| PyPI | vtk | 9.5.1 | PYSEC-2025-226 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H