Is CVE-2026-41216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41216 being exploited in the wild.

How severe is CVE-2026-41216?

High severity, with a CVSS score of 7.5, published 29 October 2026.

Is there a fix for CVE-2026-41216?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41216 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41216?

Check whether you run Kitware VTK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41216: VTK vtkPNGReader invalid pointer dereference

CVE-2026-41216 · Severity: high · CVSS 7.5 · Published 2026-10-29

VTK is an open-source 3D visualization toolkit used for scientific and medical image processing. A malicious PNG file can crash applications using VTK's PNG reader, causing a denial of service. On older systems without proper vtable protection, an attacker could potentially execute arbitrary code by crafting a specially formatted PNG file.

Technologies: Kitware VTK. Vendors: Kitware.

Quick answers

Is CVE-2026-41216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41216 being exploited in the wild.
How severe is CVE-2026-41216?: High severity, with a CVSS score of 7.5, published 29 October 2026.
Which products and versions are affected?: Kitware VTK 9.6.
Is there a fix for CVE-2026-41216?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41216 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41216?: Check whether you run Kitware VTK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An invalid pointer dereference vulnerability exists in vtkPNGReader::ExecuteInformation due to improper setjmp/longjmp usage. When a malformed PNG triggers longjmp during png_read_info, execution returns to a HandleLibPngError stack frame that has already been destroyed and overwritten by subsequent function calls. This leaves the fp (file pointer) parameter containing garbage, and the subsequent fclose(fp) dereferences an invalid pointer. An attacker who can supply a crafted PNG file triggers this via network or local file processing.

Affected products

Kitware VTK 9.6

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.