Kitware VTK Heap Buffer Overflow Vulnerability in GLTF Document Loader

A heap buffer overflow vulnerability has been identified in Kitware VTK (Visualization Toolkit) versions through 9.5.0. The issue arises in the GLTF document loader, specifically within the copy constructor of Accessor objects. When the loader processes specially crafted GLTF files, it fails to properly validate buffer boundaries, allowing for out-of-bounds memory reads.

Impact

Exploitation of this vulnerability leads to a heap buffer overflow, causing a crash and application denial-of-service. Additionally, the out-of-bounds reads could potentially disclose sensitive information.

Reproduction

The vulnerability can be reproduced by building VTK with AddressSanitizer enabled, loading the crafted GLTF files using vtkGLTFImporter, and observing the resulting heap buffer overflow crash.