This vulnerability is a memory corruption flaw in the vtkDEMReader ReadProfiles functionality of the Visualization Toolkit (vtk). A specially crafted USGS DEM file can cause a buffer overflow, which allows an attacker to corrupt memory while processing the file. Such an overwrite could lead to arbitrary code execution or other forms of system compromise within the context of the application using vtk.

The affected product is vtk version 9.6.1. Users running this specific release should verify their installations against the vendor advisory and apply any available fix.

The CVSS score of 7.5 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is file‑based, where an attacker supplies a malicious DEM file to the vtkDEMReader component. If this component is invoked by a vulnerable application that processes untrusted files, exploitation could lead to arbitrary code execution. Thus, the risk is significant.