# VTK reporting potential vulnerabilities

**URL:** https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796
**Category:** Development
**Tags:** bug, file-formats
**Created:** [July 8, 2025, 10:59am UTC](https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796 "2025-07-08T10:59:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![harrypantazis](https://discourse.vtk.org/letter_avatar_proxy/v4/letter/h/82dd89/32.png) [@harrypantazis](https://discourse.vtk.org/u/harrypantazis)
#### Post date: [July 8, 2025, 10:59am UTC](https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796/1 "2025-07-08T10:59:16Z")

</div>

Greetings,

I have been fuzzing an open-source application which depends on VTK (9.5) as part of a security code audit and have identified a series of memory errors for a specific filetype parser in VTK.

Which would be the most appropriate channel to communicate the findings without directly releasing them?

Harry

---

<div class="post-metadata">

### Author: ![mwestphal](https://discourse.vtk.org/user_avatar/discourse.vtk.org/mwestphal/32/19_2.png) [@mwestphal](https://discourse.vtk.org/u/mwestphal)
#### Post date: [July 8, 2025, 11:05am UTC](https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796/2 "2025-07-08T11:05:48Z")

</div>

Hi @harrypantazis 🙂

The discourse is the right place to share this!  
We can then create appropriate issue on our gitlab if/when needed.

Edit: I’ll check internally this is the right place.

---

<div class="post-metadata">

### Author: ![seanm](https://discourse.vtk.org/letter_avatar_proxy/v4/letter/s/a88e4f/32.png) [@seanm](https://discourse.vtk.org/u/seanm)
#### Post date: [July 10, 2025, 3:45pm UTC](https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796/3 "2025-07-10T15:45:33Z")

</div>

I’ve fuzzed some VTK file readers too. Alas, there are lots of issues with the ones I tried. It has not made it to the top of my todo list, nor anyone else’s I suspect.

Patches welcome, as they say.

---

<div class="post-metadata">

### Author: ![Landon-Huking](https://discourse.vtk.org/user_avatar/discourse.vtk.org/landon-huking/32/10618_2.png) [@Landon-Huking](https://discourse.vtk.org/u/Landon-Huking)
#### Post date: [April 17, 2026, 11:39pm UTC](https://discourse.vtk.org/t/vtk-reporting-potential-vulnerabilities/15796/4 "2026-04-17T23:39:14Z")

</div>

Hi! I know this is somewhat of an old post but has there been any updates to this? I am currently fuzzing various VTK file readers and potentially found some vulnerabilities as well. Just curious if they are similar in nature to what you found.