{"id":"CVE-2026-118590","kind":"vulnerability","aliases":["CVE-2026-118590"],"related":[],"title":"nibabel: crafted header makes array_from_file allocate unbounded memory","description":"A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.","summary":"nibabel, a Python library for reading neuroimaging file formats, has an uncontrolled memory allocation in array_from_file in nibabel/volumeutils.py when parsing a crafted file header. An attacker who can supply such a file can exhaust memory and crash the process that reads it.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["neuroimaging","nibabel","package","python"],"not_affected_if":["trusted-input-only"],"how_to_check":"- `pip show nibabel` to see the installed version\n- Check whether the application passes untrusted image files to nibabel's loaders","fix":null,"status":"open","published_at":"2026-10-29T01:17:22+00:00","first_seen_at":"2026-10-29T01:36:30+00:00","triaged_at":"2026-10-29T01:37:38+00:00","updated_at":"2026-10-29T01:37:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T01:37:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"nibabel: crafted header makes array_from_file allocate unbounded memory","impact":"low","summary":"nibabel, a Python library for reading neuroimaging file formats, has an uncontrolled memory allocation in array_from_file in nibabel/volumeutils.py when parsing a crafted file header. An attacker who can supply such a file can exhaust memory and crash the process that reads it.","category":"package","nicknames":[],"who_cares":["python","nibabel","neuroimaging"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Denial of service through memory exhaustion when parsing a crafted file","analyst_note":"Check the NVD entry and the nibabel repository for a released fix version and whether the input path is reachable remotely.","how_to_check":"- `pip show nibabel` to see the installed version\n- Check whether the application passes untrusted image files to nibabel's loaders","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that open image files supplied by users or other untrusted sources with nibabel up to 5.4.2. Pipelines that only read files the team itself produced can skip it. The sources do not give a patched release; a fix pull request was still awaiting acceptance.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000575,"input_tokens":3324,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118590':13A,16A '-2026':12A,15A '5.4.2':75C 'accept':118C 'affect':77C 'alloc':8A,34B,100C 'array':5A,36B,82C 'attack':48B,102C 'await':117C 'carri':107C 'compon':91C 'craft':2A,44B 'crash':59B 'cve':11A,14A 'detect':69C 'element':78C 'exhaust':56B 'file':7A,28B,38B,45B,54B,84C,87C 'fix':114C 'format':29B 'function':81C 'handler':93C 'header':3A,46B,92C 'issu':116C 'lead':96C 'librari':24B 'make':4A 'manipul':95C 'memori':10A,33B,57B,99C 'neuroimag':17B,27B 'nibabel':1A,18B,21B,72C 'nibabel/volumeutils.py':40B,88C 'nipi':71C 'packag':19B 'pars':42B 'possibl':104C 'process':61B 'pull':111C 'python':20B,23B 'read':26B,63B 'remot':109C 'request':112C 'secur':65C 'suppli':51B 'unbound':9A 'uncontrol':32B,98C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Applications that open image files supplied by users or other untrusted sources with nibabel up to 5.4.2. Pipelines that only read files the team itself produced can skip it. The sources do not give a patched release; a fix pull request was still awaiting acceptance.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118590","severity":null,"published_at":"2026-10-29T01:17:22+00:00","modified_at":"2026-10-29T01:17:22+00:00","first_seen_at":"2026-10-29T01:36:30+00:00","fetched_at":"2026-10-29T01:36:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}