CVE-2026-22879 is a heap-based buffer overflow vulnerability in the vtkDICOMItem::NewDataElement function of the vtk-dicom module in the VTK library. The issue arises from improper validation of array indices (CWE-129), which can lead to memory corruption. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability can be exploited remotely over the network but requires high attack complexity, with no privileges or user interaction needed. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system. No known exploits in the wild or vendor patches are currently documented.

The vulnerability allows remote attackers to cause a heap-based buffer overflow, potentially leading to arbitrary code execution or denial of service. The CVSS score reflects high impact on confidentiality, integrity, and availability. However, exploitation requires high attack complexity, which may limit practical exploitation scenarios. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should monitor official VTK and vtk-dicom project advisories for updates. No specific mitigations are provided at this time.