High

VTK NULL pointer dereference vulnerability

Disclosed: 25.08.2022
Updated: 11.10.2026 11:20

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	vtk	< 9.0.1	9.0.1

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400, CWE-476
Platform: Python (PyPI)
Package: vtk
Disclosed: 25.08.2022
Updated: 11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2022-255 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-xfhg-9pjg-xg7g - CC BY 4.0

Vulnerability history: vtk

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 08.2022 10.2025
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 3

Disclosures per year

2022: 1
2023: 0
2024: 0
2025: 3
2026: 0

31.10.2025

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector mem

Critical · 9.8 CVE-2025-57108 < 9.5.1 9.5.1
31.10.2025

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor

High · 7.1 CVE-2025-57107 < 9.5.1 9.5.1
31.10.2025

Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing

High · 7.5 CVE-2025-57106 < 9.5.1 9.5.1
25.08.2022

VTK NULL pointer dereference vulnerability this entry

High · 7.5 CVE-2021-42521 < 9.0.1 9.0.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application