TALOS 2026 2424

VTK vtkWindBladeReader FindVariableOffsets heap-based buffer overflow vulnerability

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

vtk (version(s): 9.6.1)

vtk -

7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-122 - Heap-based Buffer Overflow

VTK, or the Visualization Toolkit, is an open-source software system for 3D computer graphics, image processing, and scientific visualization. It provides a large collection of algorithms and data structures for rendering, volume visualization, geometric processing, and interaction.

vtkWindBladeReader parses the WindBlade simulation format — an ASCII .wind metadata file describing grid dimensions and variable layout, paired with binary data files containing Fortran-style record-marked float arrays.

The reader parses a malformed WindBlade data set without error. ASan reports:

The crash-site code in LoadVariableData() :

At LINE_540 , block is allocated with this->BlockSize elements. BlockSize is a size_t member variable — its value determines the buffer capacity. At LINE_563 , the triple-nested loop reads block[index] where index is computed from grid-derived extents ( SubExtent ). SubExtent encodes the spatial dimensions of the data slice being loaded.

The ASan trace shows that the allocated region is 1 byte — a new float[N] call with N == 0 produces a minimal allocation. this->BlockSize was therefore 0 at allocation time, yet the loop at LINE_556 – LINE_563 still iterates (because SubExtent ranges are non-empty), reading past the end of the buffer.

BlockSize is computed during the information phase. RequestInformation() calls ReadGlobalData() at LINE_255 , which parses the .wind metadata. When the DATA_VARIABLES keyword is encountered, ReadGlobalData() calls FindVariableOffsets() at LINE_1615 :

At LINE_726 , byteCount is a signed int read directly from the binary data file — its value is attacker-controlled. BYTES_PER_DATA equals 4. At LINE_733 , signed integer division truncates toward zero: any byteCount in the range [-3, 3] produces BlockSize == 0 . Negative values produce either 0 or a negative quotient that, cast to size_t , wraps to a very large value (a separate but related issue). No validation between LINE_727 and LINE_733 checks that byteCount is positive, a multiple of 4, or consistent with the grid dimensions declared in the .wind file.

During RequestData() , the call chain consumes BlockSize without re-checking:

SetUpFieldVars() iterates over selected variables and calls LoadVariableData() at LINE_1262 , which uses this->BlockSize at LINE_540 . No validation of BlockSize occurs between the information phase (where it is computed) and the data phase (where it is consumed).

The grid dimensions ( GRID_SIZE_X/Y/Z from the .wind file) determine the SubExtent loop bounds at LINE_556 – LINE_560 . Larger declared grids cause more iterations and deeper out-of-bounds reads from the zero-sized buffer. The attacker therefore controls both the buffer size (via byteCount ) and the read depth (via grid dimensions).

The vulnerability allows an attacker to cause a deterministic denial of service by providing a crafted WindBlade data set. On non-instrumented builds, the out-of-bounds reads silently succeed and may expose heap-resident data through the output arrays, creating a potential information disclosure vector.

Vendor Response (CVE-2026-9536)

Vendor Link:

2026-06-23 - Vendor Notification 2026-06-25 - Vendor Acknowledged 2026-06-30 - 7-Day 2026-07-02 - Follow-Up Sent 2026-07-07 - Vendor Replied, Dev Team Working 2026-08-07 - 45-Day 2026-08-22 - 60-Day 2026-09-15 - Follow-Up Sent 2026-09-21 - 90-Day 2026-09-23 - Vendor Replied, Dev Team Working 2026-10-12 - Advised Vendor Cisco Will Publish And Close Out

Emmanuel Tacheau of Cisco Talos