Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by VulDB

CVE-2026-118590nipy nibabel Header volumeutils.py array_from_file memory allocation

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in nibabel from nipy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nibabelno fix listedDEBIAN-CVE-2026-118590
Debian:13nibabelno fix listedDEBIAN-CVE-2026-118590
Debian:14nibabelno fix listedDEBIAN-CVE-2026-118590
Ubuntu:22.04:LTSnibabelno fix listedUBUNTU-CVE-2026-118590
Ubuntu:24.04:LTSnibabelno fix listedUBUNTU-CVE-2026-118590
Ubuntu:26.04:LTSnibabelno fix listedUBUNTU-CVE-2026-118590
Ubuntu:26.10nibabelno fix listedUBUNTU-CVE-2026-118590
Ubuntu:22.04:LTSnipyno fix listedUBUNTU-CVE-2026-118590
Ubuntu:24.04:LTSnipyno fix listedUBUNTU-CVE-2026-118590
Ubuntu:26.04:LTSnipyno fix listedUBUNTU-CVE-2026-118590
Ubuntu:26.10nipyno fix listedUBUNTU-CVE-2026-118590

Affected products (as reported)

VendorProductVersions
nipy nibabel 5.4.05.4.15.4.2

Weakness: CWE-789, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C

References