CVE-2026-111275
nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
NIFTI-Imaging nifti_clib
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 21 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
Text from CVE List
Affected versions 1
- nifti_clibaffected: all versions through 3.0.1CVE List
References 7
- github.com/NIFTI-Imaging/nifti_clib/pull/197Fixvia CVE List
- vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nimAdvisoryvia CVE List
- hackmd.io/@haind-pwn/cve-2026-111275-nifticlib-nifti2-dim0-oobExploitvia CVE List
- hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oobReferencevia CVE List
- github.com/NIFTI-Imaging/nifti_clib/issues/195Referencevia CVE List
- github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026Referencevia CVE List
- github.com/NIFTI-Imaging/nifti_clibReferencevia CVE List