{"id":"CVE-2026-111275","title":"nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim","summary":"nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"NIFTI-Imaging","product":"nifti_clib","affected":["nifti_clib <= 3.0.1"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:43:21.786Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111275","references":[{"url":"https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/issues/195"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/pull/197"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib"},{"url":"https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim","label":"VulnCheck Advisory: nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim"}],"tags":["cve.org"],"ingestedAt":"2026-10-15T22:48:25.447Z","slug":"CVE-2026-111275","body":"## Overview\n\nnifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.\n\n## Affected\n\n- `nifti_clib <= 3.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}