CVE-2026-111275: nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread() to crash applications or corrupt stack memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
nifti_clib versions through 3.0.1 are affected when an application uses nifti_image_read() to process NIfTI-2 headers. The vulnerable path is reached by a crafted 540-byte NIfTI-2 header.
What must an attacker be able to do?
An attacker must be able to provide a crafted NIfTI-2 file or header to an application that reads it. The supplied severity vector indicates local access, no privileges, and user interaction are required.
What is the practical impact?
Processing the crafted header can cause an application crash or corruption of stack memory. The stated integrity impact is low and availability impact is high.