CVE-2026-118589

nschloe meshio VTK Reader _vtk_42.py memory allocation

nschloe meshio

Open in Threatline Record JSON

CVSS

6.9Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-118589 A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of tTelegram: CVE Notify, 29 Oct 2026

Description

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

Text from CVE List

Affected versions 6

meshioaffected: 5.3.0CVE List
meshioaffected: 5.3.1CVE List
meshioaffected: 5.3.2CVE List
meshioaffected: 5.3.3CVE List
meshioaffected: 5.3.4CVE List
meshioaffected: 5.3.5CVE List