# RAT 3.004.3: security assessment Last checked: **2026-11-04** (vulnerability database of 2026-11-04). This page lists every known vulnerability (CVE) reported against a third-party component of RAT 3.004.3, and what it means for RAT. The machine-readable form is [openvex.json](openvex.json) (OpenVEX, about this release); the components are listed in the software bill of materials (SBOM) below. **Our commitment:** No finding sits unaddressed for more than fifteen days, and where no fixed version exists, RAT ships the newest version available. Summary: 30 findings: 12 not affected, 18 under investigation. | Component | Version | CVE | Severity | Status | Reason | Assessed | |---|---|---|---|---|---|---| | expat | 2.9.0 | CVE-2026-117610 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | expat | 2.9.0 | CVE-2026-118370 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | hdf5 | 2.2.0 | CVE-2026-120754 | Low | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | hdf5 | 2.2.0 | CVE-2026-120755 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | hdf5 | 2.2.0 | CVE-2026-120756 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | hdf5 | 2.2.0 | CVE-2026-120757 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | hdf5 | 2.2.0 | CVE-2026-120758 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119371 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119372 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119373 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119374 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119375 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119376 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119377 | Low | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119378 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119379 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119586 | High | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | sqlite3 | 3.53.4#2 | CVE-2026-119591 | Medium | Under investigation | New finding, not yet assessed. | reported 2026-11-04 | | expat | 2.9.0 | CVE-2026-113351 | High | Not affected | The affected XML parser path is not taken for any XML file RAT reads. | 2026-10-31 | | expat | 2.9.0 | CVE-2026-115506 | High | Not affected | Reached only from an optional module, on files the user opens. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2025-14932 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2025-14933 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2025-14934 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2025-14935 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2025-14936 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | netcdf-c | 4.9.3#5 | CVE-2026-86095 | High | Not affected | netCDF is present only as a dependency of VTK. RAT never opens a netCDF file and uses no remote data access, so the affected code is never called. | 2026-10-31 | | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57106 | High | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 | | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57107 | High | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 | | vtk | 9.3.0-pv5.12.1#18 | CVE-2025-57108 | Critical | Not affected | RAT never uses the VTK file readers named in the advisory: it writes VTK output files and reads only its own file formats. | 2026-10-31 | | zlib | 1.3.2#2 | CVE-2026-85091 | High | Not affected | Neither RAT nor any of the libraries it ships calls the affected zlib function. | 2026-10-31 | ## What the statuses mean - **Not affected**: the component carries the vulnerable code, but RAT is not exposed to it; the reason says why. - **Affected**: RAT is exposed; the action says what to do and when a fix ships. - **Under investigation**: reported, not yet assessed. The fifteen-day window runs from the first day it was reported. ## Software bill of materials Third-party components of each installer (SPDX). To filter a scan of these SBOMs with the assessment above, use [openvex-scan.json](openvex-scan.json), e.g. `grype sbom: --vex openvex-scan.json`. It also names each component on its own, because scanners match SBOM packages that way; apply it only to these SBOMs, not to other software. - [rat-gui-3.004.3-linux.spdx.json](sbom/rat-gui-3.004.3-linux.spdx.json) - [rat-gui-3.004.3-macos.spdx.json](sbom/rat-gui-3.004.3-macos.spdx.json) - [rat-gui-3.004.3-offline-windows.spdx.json](sbom/rat-gui-3.004.3-offline-windows.spdx.json) - [rat-gui-3.004.3-raccoon-linux.spdx.json](sbom/rat-gui-3.004.3-raccoon-linux.spdx.json) - [rat-gui-3.004.3-raccoon-macos.spdx.json](sbom/rat-gui-3.004.3-raccoon-macos.spdx.json) - [rat-gui-3.004.3-raccoon-windows.spdx.json](sbom/rat-gui-3.004.3-raccoon-windows.spdx.json) - [rat-gui-3.004.3-windows.spdx.json](sbom/rat-gui-3.004.3-windows.spdx.json) ## Third-party components
175 components | Component | Version | Platforms | |---|---|---| | armadillo | 15.6.1 | linux, macos, windows | | blas | 2023-04-14#6 | linux, macos, windows | | blis | 2.1 | linux, macos, windows | | blis | 2.1#4 | linux | | boost-algorithm | 1.92.0 | linux, macos, windows | | boost-align | 1.92.0 | linux, macos, windows | | boost-array | 1.92.0 | linux, macos, windows | | boost-asio | 1.92.0 | linux, macos, windows | | boost-assert | 1.92.0 | linux, macos, windows | | boost-atomic | 1.92.0 | linux, macos, windows | | boost-bind | 1.92.0 | linux, macos, windows | | boost-chrono | 1.92.0 | linux, macos, windows | | boost-cmake | 1.92.0 | linux, macos, windows | | boost-compat | 1.92.0 | linux, macos, windows | | boost-concept-check | 1.92.0 | linux, macos, windows | | boost-config | 1.92.0 | linux, macos, windows | | boost-container | 1.92.0 | linux, macos, windows | | boost-container-hash | 1.92.0 | linux, macos, windows | | boost-context | 1.92.0 | linux, macos, windows | | boost-conversion | 1.92.0 | linux, macos, windows | | boost-core | 1.92.0 | linux, macos, windows | | boost-date-time | 1.92.0 | linux, macos, windows | | boost-describe | 1.92.0 | linux, macos, windows | | boost-detail | 1.92.0 | linux, macos, windows | | boost-dynamic-bitset | 1.92.0 | linux, macos, windows | | boost-endian | 1.92.0 | linux, macos, windows | | boost-exception | 1.92.0 | linux, macos, windows | | boost-filesystem | 1.92.0 | linux, macos, windows | | boost-function | 1.92.0 | linux, macos, windows | | boost-function-types | 1.92.0 | linux, macos, windows | | boost-fusion | 1.92.0 | linux, macos, windows | | boost-headers | 1.92.0 | linux, macos, windows | | boost-integer | 1.92.0 | linux, macos, windows | | boost-interprocess | 1.92.0 | linux, macos, windows | | boost-intrusive | 1.92.0 | linux, macos, windows | | boost-io | 1.92.0 | linux, macos, windows | | boost-iostreams | 1.92.0 | linux, macos, windows | | boost-iterator | 1.92.0 | linux, macos, windows | | boost-lambda | 1.92.0 | linux, macos, windows | | boost-lexical-cast | 1.92.0 | linux, macos, windows | | boost-math | 1.92.0 | linux, macos, windows | | boost-move | 1.92.0 | linux, macos, windows | | boost-mp11 | 1.92.0 | linux, macos, windows | | boost-mpl | 1.92.0 | linux, macos, windows | | boost-numeric-conversion | 1.92.0 | linux, macos, windows | | boost-optional | 1.92.0 | linux, macos, windows | | boost-phoenix | 1.92.0 | linux, macos, windows | | boost-pool | 1.92.0 | linux, macos, windows | | boost-predef | 1.92.0 | linux, macos, windows | | boost-preprocessor | 1.92.0 | linux, macos, windows | | boost-proto | 1.92.0 | linux, macos, windows | | boost-random | 1.92.0 | linux, macos, windows | | boost-range | 1.92.0 | linux, macos, windows | | boost-ratio | 1.92.0 | linux, macos, windows | | boost-regex | 1.92.0 | linux, macos, windows | | boost-scope | 1.92.0 | linux, macos, windows | | boost-serialization | 1.92.0 | linux, macos, windows | | boost-smart-ptr | 1.92.0 | linux, macos, windows | | boost-spirit | 1.92.0 | linux, macos, windows | | boost-static-assert | 1.92.0 | linux, macos, windows | | boost-system | 1.92.0 | linux, macos, windows | | boost-thread | 1.92.0 | linux, macos, windows | | boost-throw-exception | 1.92.0 | linux, macos, windows | | boost-tokenizer | 1.92.0 | linux, macos, windows | | boost-tuple | 1.92.0 | linux, macos, windows | | boost-type-index | 1.92.0 | linux, macos, windows | | boost-type-traits | 1.92.0 | linux, macos, windows | | boost-typeof | 1.92.0 | linux, macos, windows | | boost-uninstall | 1.92.0 | linux, macos, windows | | boost-units | 1.92.0 | linux, macos, windows | | boost-unordered | 1.92.0 | linux, macos, windows | | boost-utility | 1.92.0 | linux, macos, windows | | boost-uuid | 1.92.0 | linux, macos, windows | | boost-variant | 1.92.0 | linux, macos, windows | | boost-variant2 | 1.92.0 | linux, macos, windows | | boost-winapi | 1.92.0 | linux, macos, windows | | brotli | 1.2.1 | linux, macos, windows | | bzip2 | 1.0.8#6 | linux, macos, windows | | cereal | 1.3.2#1 | linux, macos, windows | | cgns | 4.5.1 | linux, macos, windows | | corrade | v2020.06-2131-g4dc19896 | linux, macos, windows | | cpr | 1.14.2 | linux, macos, windows | | curl | 8.23.0 | linux, macos, windows | | dbus | 1.16.2#5 | linux | | dear-imgui | v1.93.0-docking | linux, macos, windows | | dirent | 1.26 | linux | | double-conversion | 3.4.0 | linux, macos, windows | | egl-registry | 2025-05-27 | linux, macos, windows | | eigen3 | 5.0.1 | linux, macos, windows | | ensmallen | 2.21.1#1 | linux, macos, windows | | expat | 2.9.0 | linux, macos, windows | | exprtk | 0.0.3 | linux, macos, windows | | fast-float | 8.3.1 | linux, macos, windows | | fmt | 12.2.0#1 | linux, macos, windows | | fontconfig | 2.17.1#2 | linux | | freetype | 2.14.3 | linux, macos, windows | | gklib | 2025-07-06#1 | linux, macos, windows | | gl2ps | 1.4.3 | linux, macos, windows | | glew | 2.3.1 | linux, macos, windows | | gperf | 3.3#1 | linux | | hdf5 | 2.2.0 | linux, macos, windows | | hypre | v3.2.0 | linux, macos, windows | | imgui-test-engine | v1.93.0 | linux, macos, windows | | imguifiledialog | v0.6.7-83-gf50296e | linux, macos, windows | | implot | v1.0-9-g09e2ba7 | linux, macos, windows | | implot | v1.1 | linux, macos, windows | | intel-onemkl | 2026.0 | windows | | jsoncpp | 1.9.6 | linux, macos, windows | | lapack | 2023-06-10#4 | linux, macos, windows | | lapack-reference | 3.12.1#3 | linux | | libaec | 1.1.7#1 | linux, macos, windows | | libcap | 2.78 | linux | | libharu | 2.4.6 | linux, macos, windows | | libiconv | 1.19#1 | linux, macos, windows | | libjpeg-turbo | 3.2.0#1 | linux, macos, windows | | liblzma | 5.8.4 | linux, macos, windows | | libmount | 2.41.3#1 | linux | | libogg | 1.3.6#1 | linux, macos, windows | | libpng | 1.6.59 | linux, macos, windows | | libspng | 0.7.4#1 | linux, macos, windows | | libsystemd | 260.2#1 | linux | | libtheora | 1.2.0 | linux, macos, windows | | libuuid | 1.0.3#17 | linux | | libxcrypt | 4.5.2 | linux | | libxml2 | 2.15.4 | linux, macos, windows | | lua | 5.5.1 | linux, macos, windows | | lunasvg | 3.5.0 | linux, macos, windows | | lz4 | 1.10.0 | linux, macos, windows | | magnum | v2020.06-3760-g369e9620a | linux, macos, windows | | magnum-integration | v2020.06-437-ge3d2b01 | linux, macos, windows | | magnum-plugins | v2020.06-1807-gdf8fd174 | linux, macos, windows | | meshoptimizer | v1.3 | linux, macos, windows | | metis | 2025-07-04#2 | linux, macos, windows | | mosra-toolchains | fa282e8 | linux, macos, windows | | mumps | v5.9.1.2 | linux, macos, windows | | netcdf-c | 4.9.3#5 | linux, macos, windows | | nlohmann-json | 3.12.0#2 | linux, macos, windows | | nlopt | 2.11.0 | linux, macos, windows | | opengl | 2022-12-04#3 | linux, macos, windows | | opengl-registry | 2026-08-03 | linux, macos, windows | | openssl | 3.6.5#2 | linux, macos, windows | | pegtl | 3.2.8 | linux, macos, windows | | platformfolders | 4.3.0-2-gf2625fa | linux, macos, windows | | plutovg | 1.3.3 | linux, macos, windows | | proj | 9.9.0 | linux, macos, windows | | pthread | 3.0.0#2 | linux | | pthreads | 3.0.0#14 | linux | | pugixml | 1.16 | linux, macos, windows | | sdl2 | 2.32.10#1 | linux, macos, windows | | seacas | 2022-11-22#10 | linux, macos, windows | | sol2 | 3.5.0#1 | linux, macos, windows | | sqlite3 | 3.53.4#2 | linux, macos, windows | | suitesparse-amd | 3.3.4#4 | linux, macos, windows | | suitesparse-camd | 3.3.5#4 | linux, macos, windows | | suitesparse-ccolamd | 3.3.5#4 | linux, macos, windows | | suitesparse-cholmod | 5.3.5#3 | linux, macos, windows | | suitesparse-colamd | 3.3.5#4 | linux, macos, windows | | suitesparse-config | 7.14.1 | linux, macos, windows | | sundials | 7.9.0 | linux, macos, windows | | superlu | 7.0.1 | linux, macos, windows | | tclap | 1.2.5 | linux, macos, windows | | tiff | 4.7.2 | linux, macos, windows | | tinyxml2 | 11.0.0 | linux, macos, windows | | utfcpp | 4.2.1 | linux, macos, windows | | vcpkg | 2026.10.16 | linux, macos, windows | | vcpkg-boost | 2026-08-21 | linux, macos, windows | | vcpkg-cmake | 2025-08-07 | linux, macos, windows | | vcpkg-cmake-config | 2026-07-21 | linux, macos, windows | | vcpkg-cmake-get-vars | 2025-05-29 | linux, macos, windows | | vcpkg-get-python-packages | 2025-04-05 | linux | | vcpkg-make | 2026-07-09#1 | linux, macos, windows | | vcpkg-tool-meson | 1.9.0#10 | linux | | verdict | 1.4.5 | linux, macos, windows | | vtk | 9.3.0-pv5.12.1#18 | linux, macos, windows | | vtk-compile-tools | 9.3.0-pv5.12.1#1 | linux, macos, windows | | zlib | 1.3.2#2 | linux, macos, windows | | zstd | 1.5.7 | linux, macos, windows |