{"id":"PYSEC-2025-225","details":"Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.","aliases":["CVE-2025-57107"],"modified":"2026-05-20T09:19:21.958170Z","published":"2025-10-31T15:15:42.443Z","references":[{"type":"REPORT","url":"https://gitlab.kitware.com/vtk/vtk/-/issues/19732"}],"affected":[{"package":{"name":"vtk","ecosystem":"PyPI","purl":"pkg:pypi/vtk"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.1"}]}],"versions":["8.1.0","8.1.1","8.1.2","9.0.0","9.0.1","9.0.2","9.0.3","9.1.0","9.2.2","9.2.4","9.2.5","9.2.6","9.3.0","9.3.1","9.3.20230807rc0","9.4.0","9.4.1","9.4.2","9.5.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/vtk/PYSEC-2025-225.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"}]}