CVE-2026-111275 Details
Description
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
A stack-based out-of-bounds read and write vulnerability has been identified in the NIfTI C library (nifti_clib) versions through 3.0.1. The issue arises in the function 'nifti_convert_n2hdr2nim()', which processes NIfTI-2 headers. The vulnerability is caused by the 'dim[0]' value, representing the number of dimensions, not being properly range-checked. This oversight allows attackers to craft a 540-byte NIfTI-2 header that, when read by 'nifti_image_read()', can lead to application crashes or corruption of stack memory.
Users can update to the latest version of 'nifti_clib' where this vulnerability has been addressed. Instructions for updating can be found in the project's GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haind-pwn/cve-2026-111275-nifticlib-nifti2-dim0-oob | CISA-ADP | |
| https://github.com/NIFTI-Imaging/nifti_clib | [email protected] | Vendor |
| https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026 | [email protected] | Source CodeVendor |
| https://github.com/NIFTI-Imaging/nifti_clib/issues/195 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/NIFTI-Imaging/nifti_clib/pull/197 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NIFTI-Imaging nifti_clib | <= 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |