The reported weakness in nschloe/meshio affects the VTK Reader component, specifically the _vtk_42.py file. Manipulating the DIMENSIONS argument can trigger an uncontrolled memory allocation, potentially exhausting system resources when a payload containing large dimensions is processed. The flaw resides in unsanitized handling of user‑supplied data and manifests as a denial‑of‑service vulnerability that can be triggered remotely by supplying a crafted VTK file or input through the API.

This issue impacts all installations of meshio with versions up to and including 5.3.5. The library is hosted under the nschloe:meshio project and is available for use in Python projects that read VTK files. No specific major operating systems are mentioned, so the vulnerability is likely platform‑agnostic as long as the library is imported.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is currently unavailable, suggesting limited publicly known exploitation activity. The vulnerability is not listed in the CISA KEV catalog, and no official patch has been released yet. The attack can be executed remotely by supplying an input that causes excessive memory usage. Adversaries would need to craft a VTK file or supply an input with an abnormally large DIMENSIONS value to trigger the failure, but no authentication or privileged access is required.