An invalid pointer dereference exists in vtkPNGReader::ExecuteInformation of VTK 9.6. A specially crafted PNG file can trigger the flaw and cause the application to crash, resulting in a denial of service. The vulnerability stems from improper handling of pointers during PNG processing, which does not provide any authentication or privilege escalation but can terminate the target process.

The CVE applies to the VTK library (vtk) version 9.6 as reported by the CVE Numbering Authority. No other versions are noted as affected in the available information.

The vulnerability carries a CVSS score of 7.5, indicating a high severity, but no EPSS score is available and it is not listed in the CISA KEV catalog. An attacker can exploit it by supplying a malicious PNG file to an application that uses vtkPNGReader, causing a crash that disrupts service availability. Because no active exploitation data is reported, the current likelihood of exploitation is uncertain, yet the potential for denial of service remains significant.