---
id: CVE-2026-111275
title: >-
  nifti_clib through 3.0.1 Stack Out-of-Bounds Access via
  nifti_convert_n2hdr2nim
summary: >-
  nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write
  vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is
  never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header
  read …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: NIFTI-Imaging
product: nifti_clib
affected:
  - nifti_clib <= 3.0.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:21.786Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111275'
references:
  - url: 'https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob'
  - url: 'https://github.com/NIFTI-Imaging/nifti_clib/issues/195'
  - url: 'https://github.com/NIFTI-Imaging/nifti_clib/pull/197'
  - url: >-
      https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026
  - url: 'https://github.com/NIFTI-Imaging/nifti_clib'
  - url: >-
      https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim
    label: >-
      VulnCheck Advisory: nifti_clib through 3.0.1 Stack Out-of-Bounds Access
      via nifti_convert_n2hdr2nim
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.447Z'
---

## Overview

nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.

## Affected

- `nifti_clib <= 3.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.