CVE-2026-118590: nipy nibabel Header volumeutils.py array_from_file memory allocation
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function arrayfromfile of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the PyPI package nibabel at version 5.4.2 or earlier are affected, specifically when they use the Header Handler functionality that reaches array_from_file in nibabel/volumeutils.py.
What access does an attacker need?
The issue is remotely exploitable and requires no privileges or user interaction according to the supplied vector. The provided data does not specify the input or request path used to trigger the allocation.
What is the expected impact?
Successful exploitation can cause uncontrolled memory allocation and has an availability impact. No confidentiality or integrity impact is identified in the supplied severity vector.
Is a fix available?
A pull request intended to fix the issue exists but awaits acceptance. No released fixed version is identified in the provided data.