---
id: CVE-2026-118590
title: nipy nibabel Header volumeutils.py array_from_file memory allocation
summary: >-
  A security vulnerability has been detected in nipy nibabel up to 5.4.2. The
  affected element is the function array_from_file of the file
  nibabel/volumeutils.py of the component Header Handler. The manipulation leads
  to uncontrolled memor…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-789
  - CWE-400
vendor: nipy
product: nibabel
affected:
  - nibabel 5.4.0
  - nibabel 5.4.1
  - nibabel 5.4.2
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T00:00:21.707Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118590'
references:
  - url: 'https://vuldb.com/vuln/428028'
    label: >-
      VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory
      allocation
  - url: 'https://vuldb.com/vuln/428028/cti'
    label: 'VDB-428028 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-118590'
    label: CVE-2026-118590 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1026208'
    label: 'Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation'
  - url: 'https://github.com/nipy/nibabel/issues/1566'
  - url: 'https://github.com/nipy/nibabel/pull/1587'
  - url: 'https://github.com/nipy/nibabel/'
tags:
  - cve.org
epss: 0.00419
epssPercentile: 0.36173
ingestedAt: '2026-10-30T21:09:21.622Z'
---

## Overview

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

## Affected

- `nibabel 5.4.0`
- `nibabel 5.4.1`
- `nibabel 5.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.