TALOS-2026-2423
CVE-2026-9535
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
vtk (version(s): 9.6.1)
vtk - https://vtk.org/
8.2 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
VTK, or the Visualization Toolkit, is an open-source software system for 3D computer graphics, image processing, and scientific visualization. It provides a large collection of algorithms and data structures for rendering, volume visualization, geometric processing, and interaction.
vtkChacoReader parses the Chaco plain-text graph format — a .graph file encoding topology (vertex count, edge count, 1-based adjacency lists) and an optional .coords file with vertex coordinates. The format represents a graph as a list of vertices, each followed by the IDs of its neighbors. Vertex count and edge count are declared on the first line; subsequent lines list, for each vertex, the 1-based IDs of all adjacent vertices.
The reader parses a malformed Chaco sample without error. When cell data is accessed, ASan reports:
[PoC] Update(./poc/oob_vertex_ref)
[PoC] Points: 2 Cells: 1
==4181==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50400003d020
READ of size 8 at 0x50400003d020 thread T0
#0 in vtk::detail::TupleRange<...>::GetTuple(long long, double*) const
/opt/vtk-src/Common/Core/vtkDataArrayTupleRange_AOS.h:1023:18
[...]
#10 in vtkPoints::GetPoints(vtkIdList*, vtkPoints*)
/opt/vtk-src/Common/Core/vtkPoints.cxx:109:8
[...]
#12 in vtkUnstructuredGrid::GetCell(long long)
/opt/vtk-src/Common/DataModel/vtkUnstructuredGrid.cxx:365:9
#13 in main
/manuwork/advisories/chaco-geometry-1/poc_vtkchacoreader_update.cpp:35:26
Address 0x50400003d020 is a wild pointer inside of access range of size 0x000000000008.
Output grid: 2 points, 1 cell — no warning emitted. The call chain runs from GetCell() (frame #12) through GetPoints() (frame #10) into GetTuple() (frame #0), where the 8-byte heap read lands at address 0x50400003d020.
The crash occurs in a templated worker function dispatched by GetPoints(). The relevant line:
LINE_76 void operator()(Array1T* src, Array2T* dst) const
LINE_77 {
[...]
LINE_88 srcTuples.GetTuple(idsPtr[i], point);
[...]
}
GetTuple() at LINE_88 reads a point’s coordinates from the points array using idsPtr[i] as an index. idsPtr is a raw pointer into a list of point IDs passed down from GetCell().
One level up in the call stack (frame #12), vtkUnstructuredGrid::GetCell() retrieves those point IDs:
LINE_370 void vtkUnstructuredGrid::GetCell(vtkIdType cellId, vtkGenericCell* cell)
LINE_371 {
[...]
LINE_375 this->Connectivity->GetCellAtId(cellId, cell->PointIds);
LINE_376 this->Points->GetPoints(cell->PointIds, cell->Points);
[...]
}
this->Connectivity is a vtkCellArray — an array that stores, for each cell, the list of point IDs that define it. GetCellAtId() at LINE_375 reads point IDs from that array into cell->PointIds. Those IDs are then passed to GetPoints() at LINE_376, which dispatches to the worker shown above.
Connectivity is populated by SetCells() at LINE_616 in vtkChacoReader::ReadFile(), which builds the grid. The adjacency data fed into that connectivity comes from InputGraph2(), called at LINE_468:
LINE_269 int vtkChacoReader::ReadFile(vtkUnstructuredGrid* output)
LINE_270 {
[...]
LINE_468 rc = this->InputGraph2(&idx, &nbors, vw, ew);
[...]
}
InputGraph2() reads each neighbor vertex ID — attacker-controlled — from the .graph file via ReadInt() and stores it in the adjacency output array:
LINE_1022 int vtkChacoReader::InputGraph2(
LINE_1023 vtkIdType** start, vtkIdType** adjacency,
LINE_1024 double** vweights, double** eweights)
LINE_1025 {
[...]
LINE_1175 neighbor = this->ReadInt(fin, &end_flag);
[...]
LINE_1200 if (++sum_edges > 2 * narcs)
LINE_1201 {
LINE_1202 vtkErrorMacro(<< "Too many adjacencies " ...);
LINE_1203 retVal = 0;
LINE_1204 goto done;
LINE_1205 }
LINE_1209 *adjptr++ = neighbor;
[...]
}
The guard at LINE_1200 caps total adjacency count, not individual values. The valid range for neighbor is [1, nvtxs] — each neighbor ID should reference an existing vertex. But whether neighbor falls within that range is never verified; the value is stored as-is at LINE_1209. This is the design flaw: a bounds check on neighbor between LINE_1175 and LINE_1209 would prevent any out-of-range vertex ID from reaching the output.
Back in ReadFile(), points are allocated at LINE_354 for exactly NumberOfVertices entries (attacker-controlled, read from the first line of the .graph file). The adjacency array returned by InputGraph2() is then converted into cell connectivity — each adjacency entry becomes a two-point VTK_LINE cell:
LINE_269 int vtkChacoReader::ReadFile(vtkUnstructuredGrid* output)
LINE_270 {
[...]
LINE_354 ptarray->SetNumberOfPoints(this->NumberOfVertices);
[...]
LINE_553 vtkIdType nbor = nbors[n] - 1; // 1-based → 0-based
LINE_557 if (nbor > id) // deduplication filter
LINE_570 *captr++ = nbor; // stored as point ID
[...]
LINE_616 output->SetCells(VTK_LINE, cells);
[...]
}
The condition nbor > id at LINE_557 filters duplicate edges — it ensures each edge is stored once. It is not a bounds check. At LINE_616, SetCells() commits the full connectivity array to the output grid.
A neighbor ID read from the file at LINE_1175 flows through InputGraph2() (stored at LINE_1209), into the adjacency array nbors, through ReadFile() (converted to 0-based at LINE_553, stored as a point ID at LINE_570), and into cell connectivity via SetCells() at LINE_616. When GetCell() later resolves that cell, GetTuple() uses the stored ID as an index into the points array. Since points are allocated for NumberOfVertices entries, any index above NumberOfVertices - 1 reads beyond the buffer.
File content controls the read offset (neighbor field) and the buffer size (num_vertices header) independently. A specially crafted .graph file causes denial of service on cell access; on non-instrumented builds, heap contents leak as double coordinate values — e.g. through exported geometry.
An out-of-bounds read vulnerability exists in VTK’s vtkChacoReader class. A specially crafted .graph file containing an out-of-range neighbor vertex ID triggers a heap-buffer-overflow read when the application accesses cell data on the resulting vtkUnstructuredGrid.
[PoC] Points: 2 Cells: 1 ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50400003d020 at pc 0x7fb588610ee3 bp 0x7fffd3184950 sp 0x7fffd318494[80/1196]
READ of size 8 at 0x50400003d020 thread T0 [79/1196]
#0 0x7fb588610ee2 in vtk::detail::TupleRange<vtkAOSDataArrayTemplate<double>, 3>::GetTuple(long long, double*) const /opt/vtk-src/C[78/1196]
e/vtkDataArrayTupleRange_AOS.h:1023:18 [77/1196]
#1 0x7fb588610ee2 in void GetTuplesFromListWorker::operator()<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemplate<double>>(vtk[76/1196]
rayTemplate<double>*, vtkAOSDataArrayTemplate<double>*) const /opt/vtk-src/Common/Core/vtkPoints.cxx:87:17 [75/1196]
#2 0x7fb58860c43b in bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::Type[74/1196]
OSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double[73/1196]
eList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkT[72/1196]
TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTempla[71/1196]
>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()::operator()() co[70/1196]
vtk-src/Common/Core/vtkArrayDispatch.txx:317:9 [69/1196]
#3 0x7fb58860c43b in void std::__invoke_impl<void, bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemp[68/1196]
t>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<[67/1196]
aArrayTemplate<double>, vtkTypeList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOS[66/1196]
Template<float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<[65/1196]
vtkAOSDataArrayTemplate<double>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>[64/1196]
a'()>(std::__invoke_other, bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::Ty[63/1196]
kAOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<doub[62/1196]
ypeList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vt[61/1196]
::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemp[60/1196]
le>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()&&) /usr/lib/gc[59/1196]
linux-gnu/13/../../../../include/c++/13/bits/invoke.h:61:14 [58/1196]
#4 0x7fb58860c43b in std::__invoke_result<bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<floa[57/1196]
peList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADat[56/1196]
plate<double>, vtkTypeList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArray[55/1196]
float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, [54/1196]
aArrayTemplate<double>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambd[53/1196]
pe std::__invoke<bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::TypeList<vtk[52/1196]
rayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double>, vtkTy[51/1196]
ypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList:[50/1196]
<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemplate<doubl[49/1196]
plesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()>(bool vtkArrayDispatch::[48/1196]
patch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::TypeLi[47/1196]
DataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double>, vtkTypeList::TypeList<vtkStructuredPointArray<double>,[46/1196]
ist::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTyp[45/1196]
llType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemplate<double>, GetTuplesFromListWorker&>(vtkAbstractArray*, [44/1196]
ctArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()&&) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invok[43/1196]
#5 0x7fb58860c43b in decltype(auto) std::__apply_impl<bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayT[42/1196]
loat>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeLi[41/1196]
DataArrayTemplate<double>, vtkTypeList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtk[40/1196]
rayTemplate<float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTempla[39/1196]
>, vtkAOSDataArrayTemplate<double>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tupl[38/1196]
mbda'(), std::tuple<>>(bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::TypeLi[37/1196]
DataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double>,[36/1196]
ist::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTyp[35/1196]
peList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemplate[34/1196]
GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()&&, std::tuple<>&&,[33/1196]
eger_sequence<unsigned long, ...>) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/tuple:2302:14 [32/1196]
#6 0x7fb58860c43b in decltype(auto) std::apply<bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate[31/1196]
vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkS[30/1196]
ayTemplate<double>, vtkTypeList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSData[29/1196]
late<float>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<doub[28/1196]
OSDataArrayTemplate<double>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'[27/1196]
, std::tuple<>>(bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::TypeList<vtkA[26/1196]
ayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double>, vtkTyp[25/1196]
peList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::[24/1196]
vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTemplate<double[23/1196]
lesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>)::'lambda'()&&, std::tuple<>&&) /usr/l[22/1196]
6_64-linux-gnu/13/../../../../include/c++/13/tuple:2313:14 [21/1196]
#7 0x7fb58860c43b in bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::Type[20/1196]
OSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double[19/1196]
eList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkT[18/1196]
TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::ExecuteKnown<vtkAOSDataArrayTemplate<double>, vtkAOSDataArrayTempla[17/1196]
>, GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArray*, GetTuplesFromListWorker&, std::tuple<>) /opt/vtk-src/Common/Core/vtk[16/1196]
atch.txx:315:5 [15/1196]
#8 0x7fb58860b6ec in bool vtkArrayDispatch::impl::Dispatch2<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::Type[14/1196]
OSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double[13/1196]
eList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkT[12/1196]
TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::Execute<GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArr[11/1196]
uplesFromListWorker&) /opt/vtk-src/Common/Core/vtkArrayDispatch.txx:400:14 [10/1196]
#9 0x7fb588606ce3 in bool vtkArrayDispatch::Dispatch2ByArray<vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkTypeList::Type[9/1196]
AOSDataArrayTemplate<double>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<float>, vtkTypeList::TypeList<vtkSOADataArrayTemplate<double[8/1196]
peList::TypeList<vtkStructuredPointArray<double>, vtkTypeList::NullType>>>>>, vtkTypeList::TypeList<vtkAOSDataArrayTemplate<float>, vtkT[7/1196]
:TypeList<vtkAOSDataArrayTemplate<double>, vtkTypeList::NullType>>>::Execute<GetTuplesFromListWorker&>(vtkAbstractArray*, vtkAbstractArr[6/1196]
TuplesFromListWorker&) /opt/vtk-src/Common/Core/vtkArrayDispatch.txx:1402:12 [5/1196]
#10 0x7fb588606ce3 in vtkPoints::GetPoints(vtkIdList*, vtkPoints*) /opt/vtk-src/Common/Core/vtkPoints.cxx:109:8 [4/1196]
#11 0x7fb58c16a4e5 in vtkUnstructuredGrid::GetCell(long long, vtkGenericCell*) /opt/vtk-src/Common/DataModel/vtkUnstructuredGrid.cxx[3/1196]
#12 0x7fb58c16a148 in vtkUnstructuredGrid::GetCell(long long) /opt/vtk-src/Common/DataModel/vtkUnstructuredGrid.cxx:365:9 [2/1196]
#13 0x558dbecc15c4 in main /manuwork/advisories/chaco-geometry-1/poc_vtkchacoreader_update.cpp:35:26 [1/1196]
#14 0x7fb57e3f81c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#15 0x7fb57e3f828a in __libc_start_main csu/../csu/libc-start.c:360:3
#16 0x558dbebdd5b4 in _start (/manuwork/advisories/chaco-geometry-1/build-afl/poc_vtkchacoreader_update+0x2e5b4) (BuildId: 8a59cd00294a130b77be5703a15191ce2f6e6f9c)
Address 0x50400003d020 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: heap-buffer-overflow /opt/vtk-src/Common/Core/vtkDataArrayTupleRange_AOS.h:1023:18 in vtk::detail::TupleRange<vtkAOSDataArrayTemplate<double>, 3>::GetTuple(long long, double*) const
Shadow bytes around the buggy address:
0x50400003cd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003ce00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003ce80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003cf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003cf80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x50400003d000: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa
0x50400003d080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003d100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003d180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003d200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50400003d280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Vendor Link: https://vtk.org/download/
2026-06-23 - Vendor Notification
2026-06-25 - Vendor Acknowledged
2026-06-30 - 7-Day
2026-07-02 - Follow-Up Sent
2026-07-07 - Vendor Replied, Dev Team Working
2026-08-07 - 45-Day
2026-08-22 - 60-Day
2026-09-15 - Follow-Up Sent
2026-09-21 - 90-Day
2026-09-23 - Vendor Replied, Dev Team Working
2026-10-12 - Advised Vendor Cisco Will Publish And Close Out
Emmanuel Tacheau of Cisco Talos