Shaking the Mesh: Four Memory Corruption Bugs in VTK's GLTF Loader

Thu, 30 Oct 2025 00:00:00 +0000

“The future is already here — it’s just not evenly distributed.” — William Gibson

How I Got Here

In mid-2025 I scoped out an engagement for Radically Open Security targeting F3D — a fast, minimalist 3D viewer that supports dozens of file formats — and its library counterpart, libf3d. The proposal focused on three attack surfaces:

Code audit and pentesting of f3d and libf3d.

Our primary target is the libf3d since its API is used by third-party projects and security issues are more critical.

Vtk on harpi - Security Researcher

Shaking the Mesh: Four Memory Corruption Bugs in VTK's GLTF Loader

How I Got Here