The vulnerability is an out-of-bounds read in the vtkChacoReader InputGraph2 functionality. An attacker can supply a specially crafted chaco file that causes the reader to access memory beyond the intended buffer. This can expose sensitive data that should reside elsewhere in memory, leading to information disclosure. The flaw stems from insufficient bounds checking during file parsing (CWE-125).

The issue affects the vtk library, specifically version 9.6.1. Users running this version should verify and upgrade if necessary.

With a CVSS score of 8.2, the flaw is considered high severity. The EPSS score is unavailable, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local: an attacker needs to deliver a malicious chaco file to the vulnerable system, either directly or via a compromised application that ingests such files. Once supplied, the out-of-bounds read can be exploited to leak memory contents.