Search
Find a vulnerability
Search criteria
2 vulnerabilities by nipy
CVE-2026-118590 (GCVE-0-2026-118590)
Vulnerability from nvd – Published: 2026-10-29 00:00 – Updated: 2026-11-04 01:09
VLAI
EPSS
VEX
Title
nipy nibabel Header volumeutils.py array_from_file memory allocation
Summary
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:09 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428028 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428028/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118590 | third-party-advisory |
| https://vuldb.com/submit/1026208 | third-party-advisory |
| https://github.com/nipy/nibabel/issues/1566 | issue-tracking |
| https://github.com/nipy/nibabel/pull/1587 | issue-trackingpatch |
| https://github.com/nipy/nibabel/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:09:00.738918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:09:13.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"
],
"modules": [
"Header Handler"
],
"product": "nibabel",
"vendor": "nipy",
"versions": [
{
"status": "affected",
"version": "5.4.0"
},
{
"status": "affected",
"version": "5.4.1"
},
{
"status": "affected",
"version": "5.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T00:00:21.707Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428028"
},
{
"name": "VDB-428028 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428028/cti"
},
{
"name": "CVE-2026-118590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118590"
},
{
"name": "Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026208"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nipy/nibabel/issues/1566"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nipy/nibabel/pull/1587"
},
{
"tags": [
"product"
],
"url": "https://github.com/nipy/nibabel/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T17:24:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "nipy nibabel Header volumeutils.py array_from_file memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118590",
"datePublished": "2026-10-29T00:00:21.707Z",
"dateReserved": "2026-10-28T16:19:42.890Z",
"dateUpdated": "2026-11-04T01:09:13.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118590 (GCVE-0-2026-118590)
Vulnerability from cvelistv5 – Published: 2026-10-29 00:00 – Updated: 2026-11-04 01:09
VLAI
EPSS
VEX
Title
nipy nibabel Header volumeutils.py array_from_file memory allocation
Summary
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:09 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428028 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428028/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118590 | third-party-advisory |
| https://vuldb.com/submit/1026208 | third-party-advisory |
| https://github.com/nipy/nibabel/issues/1566 | issue-tracking |
| https://github.com/nipy/nibabel/pull/1587 | issue-trackingpatch |
| https://github.com/nipy/nibabel/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:09:00.738918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:09:13.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"
],
"modules": [
"Header Handler"
],
"product": "nibabel",
"vendor": "nipy",
"versions": [
{
"status": "affected",
"version": "5.4.0"
},
{
"status": "affected",
"version": "5.4.1"
},
{
"status": "affected",
"version": "5.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T00:00:21.707Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428028"
},
{
"name": "VDB-428028 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428028/cti"
},
{
"name": "CVE-2026-118590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118590"
},
{
"name": "Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026208"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nipy/nibabel/issues/1566"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/nipy/nibabel/pull/1587"
},
{
"tags": [
"product"
],
"url": "https://github.com/nipy/nibabel/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T17:24:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "nipy nibabel Header volumeutils.py array_from_file memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118590",
"datePublished": "2026-10-29T00:00:21.707Z",
"dateReserved": "2026-10-28T16:19:42.890Z",
"dateUpdated": "2026-11-04T01:09:13.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}