nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- References+1 references (now 7)NVD modified 2026-10-21 02:17
- StatusReceived → DeferredNVD modified 2026-10-16 18:25
- First seenCVSS 6.9NVD modified 2026-10-15 22:19
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/NIFTI-Imaging/nifti_clib
- https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026
- https://github.com/NIFTI-Imaging/nifti_clib/issues/195
- https://github.com/NIFTI-Imaging/nifti_clib/pull/197
- https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob
- https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim
- https://hackmd.io/@haind-pwn/cve-2026-111275-nifticlib-nifti2-dim0-oob