A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::NewDataElement function within the vtk-dicom component of the VTK library. This vulnerability is identified as CVE-2026-22879 and is classified under CWE-129 (Improper Validation of Array Index). The vulnerability has a high severity rating and a CVSS 3.1 vector indicating network attack complexity is high, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. No affected versions or patches are currently specified.