CVE-2025-57108 Use after free in n/a
A heap use-after-free in VTK allows attackers to execute code or cause denial of service via crafted GLTF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57108?
CVE-2025-57108 is a critical use after free vulnerability in n/a, published on 31 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
Weakness: CWE-416
Which versions are affected by CVE-2025-57108?
1 open source package ship an affected version, including vtk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vtk PyPI | All versions | 9.5.1 |
Products include Vtk Vtk.
How do I fix CVE-2025-57108?
Upgrade vtk to 9.5.1 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-57108 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57108 exists.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2025-57108, GHSA-9frg-3876-q98g, PYSEC-2025-226, UBUNTU-CVE-2025-57108.