An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a high-severity impact including denial of service. The vulnerability is identified as CVE-2026-9535 with a CVSS score of 8.2.