External risk intelligence

Kitware VTK Heap Use-After-Free in GLTF Mesh Loading

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-57108

VTK (Visualization Toolkit) is a software library used for developing applications that perform 3D computer graphics, image processing, and visualization. It is typically integrated into standalone software, developer tools, or specialized desktop applications rather than deployed as an internet-facing service, gateway, or public-facing network appliance.

Use After Free

Vtk

9.5.0 and earlier

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Kitware VTK, a software library used for 3D graphics and visualization. This issue could allow for unauthorized access and manipulation of data if exploited through specially crafted GLTF files. The main concern is confirming if this technology is used within our environment.

Code flaw affects 3D graphics library.
Important for confirming relevant software usage.
Assess exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by providing a specially crafted GLTF file to an application that uses a vulnerable version of VTK. The vulnerability exists within the `vtkGLTFDocumentLoader` when processing mesh data, specifically during copy operations that involve vector members and corrupted GLTF references. Successful exploitation could lead to attackers gaining control over the application's execution flow.

Malicious GLTF file provided.
Vulnerable mesh object copy operation.
Remote code execution, data corruption, or denial of service.

Live Threat

Current exploitation, exposure, and threat context

A heap use-after-free vulnerability in the GLTF document loader could allow attackers to crash applications processing GLTF files with corrupted mesh references. This issue arises from improper handling of vector members during object copy operations when memory has already been deallocated.

Application crashes when processing GLTF.
Corrupted GLTF files trigger memory errors.
Service interruption or application instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Kitware VTK is a library commonly integrated into other applications, meaning ownership will likely reside with the teams responsible for those applications, such as development, platform, or specific product owners. The first practical step is to identify where VTK is utilized within your environment, determine its reachability and criticality, and then locate the accountable application owner to coordinate remediation.

Application owners should confirm VTK usage.
Verify exposure and business criticality first.
Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kitware VTK?

Kitware VTK, or the Visualization Toolkit, is a powerful open-source software library. Developers use it to build sophisticated applications that handle 3D computer graphics, complex image processing, and scientific data visualization. Because it functions as a toolkit, it is usually embedded as a component within larger software packages, developer tools, or specialized desktop applications rather than running as a standalone service.

What does CVE-2025-57108 mean?

This CVE identifies a heap use-after-free vulnerability, which is a type of memory management error classified as CWE-416. It occurs when an application continues to use a memory location after that memory has been deallocated or freed. In this case, the flaw exists in how the library manages mesh data during specific copy operations within the GLTF file loader.

How is this vulnerability triggered?

An attacker triggers this flaw by supplying a specially crafted or corrupted GLTF file to an application that utilizes a vulnerable version of VTK. The error manifests during the loading process when the software performs an object copy operation on mesh data. Notably, standard, well-formed GLTF files that do not contain invalid or malicious mesh references do not trigger this memory error.

Is my environment at risk from this?

Risk depends on whether you run software that embeds VTK to process external GLTF files. Halo Surface Signal notes that since VTK is typically integrated into internal developer tools or desktop software, it is very unlikely to be exposed as an internet-facing service. You should check if any of your internal applications use VTK versions up to 9.5.0 for processing untrusted graphics files.

What should I do if I use this software?

The first step is to perform an inventory to identify which internal applications or development projects rely on the VTK library. Once you confirm usage, coordinate with the specific application owners or development teams responsible for those tools. They will need to evaluate the criticality of the integration and plan for updates to a patched version once available.

References

gitlab.kitware.com/vtk/vtk/-/issues/19736

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.