{"id":"CVE-2026-111275","title":"nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim","summary":"nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"NIFTI-Imaging","product":"nifti_clib","affected":["nifti_clib <= 3.0.1"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T01:37:15.716658Z"},"exploitAvailable":true,"published":"2026-10-15","updated":"2026-10-21","sourceUpdated":"2026-10-21T01:37:40.421Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111275","references":[{"url":"https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/issues/195"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/pull/197"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026"},{"url":"https://github.com/NIFTI-Imaging/nifti_clib"},{"url":"https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim","label":"VulnCheck Advisory: nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111275.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111275"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111275"}],"tags":["cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00196,"epssPercentile":0.09195,"ingestedAt":"2026-10-15T22:48:25.447Z","slug":"CVE-2026-111275","body":"## Overview\n\nnifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.\n\n## Affected\n\n- `nifti_clib <= 3.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111275.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":226816,"id":"CVE-2026-111275","ts":1792550358673,"field":"exploit_available","old":"false","new":"true"}]}