The flaw involves a memory corruption in VTK’s vtkBMPReader ExecuteDataWithInformation function, triggered by a specially crafted BMP file, which causes a buffer overflow. Based on the description, it is inferred that the overflow may allow an attacker to execute arbitrary code in the context of the process.

The flaw is found in VTK, specifically the vtkBMPReader component for version 9.6.1. No other versions or product variants are currently listed as affected.

Based on the description, it is inferred that a successful buffer overflow could enable arbitrary code execution. The CVSS score of 7.5 indicates a high severity level, and the vulnerability is not yet listed in CISA’s KEV catalog. EPSS data is unavailable, but given the nature of a buffer overflow in a widely used image reader, the probability of exploitation is considered significant if an attacker can supply a malicious BMP file to the vulnerable process. The likely attack vector is local file input, although any scenario that allows the application to read untrusted BMP files—such as a network service that accepts image uploads—could be abused.