UBUNTU-CVE-2026-118590: Medium severity ubuntu/nibabel vulnerability
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function arrayfromfile of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Frequently Asked Questions
Does an attacker need credentials or user interaction to exploit this issue?
No. The CVSS vector indicates network access, low attack complexity, no privileges required, and no user interaction required.
Is a vendor fix available yet?
The referenced pull request to fix the issue is awaiting acceptance. No released fixed version is identified in the provided information.
Which Ubuntu software should be assessed?
Assess deployments of ubuntu/nibabel and ubuntu/nipy that use nibabel's Header Handler functionality. The affected function is array_from_file in nibabel/volumeutils.py, with nibabel versions through 5.4.2 identified as affected.