The vulnerability is an invalid pointer dereference in the vtkPNGReader::vtkPNGReaderUpdate2 method of VTK 9.6, classified as CWE-825. When a specially crafted PNG file is processed, the software attempts to access memory it does not own, causing a crash and leading to a denial of service for the application or process that loaded the file. The impact is loss of availability, with no direct compromise of confidentiality or integrity reported.

The affected product is VTK from the vtk vendor, specifically version 9.6. No other versions are explicitly listed in the description, so the scope is limited to this release.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available and KEV does not list the vulnerability. Based on the description, it is inferred that the likely attack vector is the delivery of a malicious PNG file to any application that uses vtkPNGReader::vtkPNGReaderUpdate2. The impact is a denial of service through a crash caused by an invalid pointer dereference. The absence of publicly available exploits makes the real‑world exploitation probability unclear, so the risk remains uncertain despite the high severity.