CVE-2026-118590 Details
Description
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
A vulnerability allowing uncontrolled memory allocation has been identified in NiBabel versions through 5.4.2. The issue arises in the 'array_from_file' function within 'nibabel/volumeutils.py', part of the Header Handler component. This vulnerability can be exploited remotely, leading to a denial-of-service condition by causing excessive memory usage.
A pull request to address this vulnerability has been submitted and is awaiting acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nipy/nibabel/ | [email protected] | Source CodeVendor |
| https://github.com/nipy/nibabel/issues/1566 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/nipy/nibabel/pull/1587 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118590 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1026208 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/428028 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/428028/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nipy nibabel | <= 5.4.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |