A heap‑based buffer overflow exists in the vtkWindBladeReader FindVariableOffsets function of the VTK library. The flaw is triggered by parsing a specially crafted ".wind" file, allowing an attacker to overwrite heap memory. This overflow can lead to arbitrary code execution or cause a denial‑of‑service if the corrupted execution flow crashes the application. The vulnerability is a classic example of CWE‑122, which undermines memory safety and can compromise the confidentiality, integrity, or availability of the host process. Affected systems The VTK library version 9.6.1 is affected. No other product or version information was provided, so only the named release is known to be vulnerable. Risk and exploitability The CVSS score of 7.5 indicates a high‑severity flaw. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves providing a malicious ".wind" file to any application that uses vtkWindBladeReader for file ingestion, which could be local or remote if the application accepts user‑supplied files.

VTK library version 9.6.1

The vulnerability is high severity with a CVSS of 7.5. EPSS data is not provided, so the exact likelihood of exploitation is unknown, but the issue sits in a critical buffer overflow that could enable code execution if a crafted file is processed. It is not catalogued in CISA KEV. The attack requires the attacker to supply a malicious ".wind" file to an application that uses the vulnerable VTK component, making it most likely an insider or remote file‑delivery scenario where the application accepts untrusted input.