| Title | nschloe meshio 5.3.5 Uncontrolled Memory Allocation |
|---|
| Description | meshio up to 5.3.5 is affected by uncontrolled memory allocation leading to denial of service in its VTK reader. When reading a legacy VTK file, the reader constructs numpy arrays sized from the DIMENSIONS header field without requiring that a matching data section actually be present (meshio/_vtk_42.py and meshio/_vtk_51.py). An attacker can craft a very small file that declares huge dimensions, causing meshio to attempt an enormous allocation. Runtime verified against the latest release: a 114-byte crafted file drives an allocation of about 192 GB, which is enough to crash or hang any service parsing untrusted mesh input. CWE-789. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5. Suggested fix: validate the declared dimensions against the available data length before allocating. |
|---|
| Source | ⚠️ https://github.com/nschloe/meshio/issues/1576 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 20:33 (17 days ago) |
|---|
| Moderation | 10/28/2026 17:17 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 428027 [nschloe meshio up to 5.3.5 VTK Reader meshio/_vtk_42.py DIMENSIONS memory allocation] |
|---|
| Points | 20 |
|---|