RAT security assessment
Last checked: 2026-11-04
Every supported RAT release is re-scanned daily against the current vulnerability databases. Each finding against a third-party component is listed below with our assessment of what it means for RAT.
Our commitment. No finding sits unaddressed for more than fifteen days, and where no fixed version exists, RAT ships the newest version available.
Releases
RAT 3.004.4
30 findings: 12 not affected, 18 under investigation
177 third-party components
RAT 3.004.3
30 findings: 12 not affected, 18 under investigation
177 third-party components
RAT 3.004.2
31 findings: 12 not affected, 19 under investigation
176 third-party components
Findings
| Release | Component | Version | CVE | Status | Reason | Assessed |
|---|---|---|---|---|---|---|
| 3.004.4 | expat | 2.9.0 | CVE-2026-117610 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | expat | 2.9.0 | CVE-2026-118370 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | hdf5 | 2.2.0 | CVE-2026-120754 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | hdf5 | 2.2.0 | CVE-2026-120755 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | hdf5 | 2.2.0 | CVE-2026-120756 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | hdf5 | 2.2.0 | CVE-2026-120757 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | hdf5 | 2.2.0 | CVE-2026-120758 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119371 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119372 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119373 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119374 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119375 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119376 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119377 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119378 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119379 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119586 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | sqlite3 | 3.53.4#2 | CVE-2026-119591 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.4 | expat | 2.9.0 | CVE-2026-113351 | Not affected | The affected XML parser path is not taken for any XML file RAT reads. | 2026-10-31 |
| 3.004.4 | expat | 2.9.0 | CVE-2026-115506 | Not affected | Reached only from an optional module, on files the user opens. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2025-14932 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2025-14933 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2025-14934 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2025-14935 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2025-14936 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | netcdf-c | 4.9.3#5 | CVE-2026-86095 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.4 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57106 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.4 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57107 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.4 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57108 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.4 | zlib | 1.3.2#2 | CVE-2026-85091 | Not affected | Neither RAT nor any of the libraries it ships calls the affected zlib function. | 2026-10-31 |
| 3.004.3 | expat | 2.9.0 | CVE-2026-117610 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | expat | 2.9.0 | CVE-2026-118370 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | hdf5 | 2.2.0 | CVE-2026-120754 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | hdf5 | 2.2.0 | CVE-2026-120755 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | hdf5 | 2.2.0 | CVE-2026-120756 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | hdf5 | 2.2.0 | CVE-2026-120757 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | hdf5 | 2.2.0 | CVE-2026-120758 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119371 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119372 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119373 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119374 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119375 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119376 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119377 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119378 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119379 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119586 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | sqlite3 | 3.53.4#2 | CVE-2026-119591 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.3 | expat | 2.9.0 | CVE-2026-113351 | Not affected | The affected XML parser path is not taken for any XML file RAT reads. | 2026-10-31 |
| 3.004.3 | expat | 2.9.0 | CVE-2026-115506 | Not affected | Reached only from an optional module, on files the user opens. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2025-14932 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2025-14933 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2025-14934 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2025-14935 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2025-14936 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | netcdf-c | 4.9.3#5 | CVE-2026-86095 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.3 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57106 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.3 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57107 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.3 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57108 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.3 | zlib | 1.3.2#2 | CVE-2026-85091 | Not affected | Neither RAT nor any of the libraries it ships calls the affected zlib function. | 2026-10-31 |
| 3.004.2 | brotli | 1.2.0 | CVE-2026-111497 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | expat | 2.9.0 | CVE-2026-117610 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | expat | 2.9.0 | CVE-2026-118370 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | hdf5 | 2.2.0 | CVE-2026-120754 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | hdf5 | 2.2.0 | CVE-2026-120755 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | hdf5 | 2.2.0 | CVE-2026-120756 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | hdf5 | 2.2.0 | CVE-2026-120757 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | hdf5 | 2.2.0 | CVE-2026-120758 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119371 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119372 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119373 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119374 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119375 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119376 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119377 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119378 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119379 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119586 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | sqlite3 | 3.53.4#2 | CVE-2026-119591 | Under investigation | New finding, not yet assessed. | reported 2026-11-04 |
| 3.004.2 | expat | 2.9.0 | CVE-2026-113351 | Not affected | The affected XML parser path is not taken for any XML file RAT reads. | 2026-10-31 |
| 3.004.2 | expat | 2.9.0 | CVE-2026-115506 | Not affected | Reached only from an optional module, on files the user opens. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2025-14932 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2025-14933 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2025-14934 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2025-14935 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2025-14936 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | netcdf-c | 4.9.3#5 | CVE-2026-86095 | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 |
| 3.004.2 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57106 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.2 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57107 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.2 | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57108 | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 |
| 3.004.2 | zlib | 1.3.2#2 | CVE-2026-85091 | Not affected | Neither RAT nor any of the libraries it ships calls the affected zlib function. | 2026-10-31 |
Statuses
Not affected the component carries the vulnerable code, but RAT is not exposed to it. Affected RAT is exposed; the reason says what to do. Under investigation reported and not yet assessed; the fifteen-day window runs from the day it was reported.
Machine-readable: one OpenVEX document per release (openvex.json). To filter a scan of a release's own SBOMs, use grype sbom:<sbom> --vex openvex-scan.json: it also names each component on its own, because scanners match SBOM packages that way, so apply it only to that release's SBOMs, not to other software.