{"id":"CVE-2026-111275","published":"2026-10-15T22:19:28.623","lastModified":"2026-10-16T18:25:45.343","description":"nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/NIFTI-Imaging/nifti_clib","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/issues/195","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/pull/197","tags":[]},{"url":"https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob","tags":[]},{"url":"https://www.vulncheck.com/advisories/nifti-clib-through-3.0.1-stack-out-of-bounds-access-via-nifti-convert-n2hdr2nim","tags":[]}],"exploitRefs":[{"url":"https://github.com/NIFTI-Imaging/nifti_clib","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/blob/96b9954fafcf3bd69a4ee2091b0d707ed2077697/nifti2/nifti2_io.c#L4985-L5026","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/issues/195","tags":[]},{"url":"https://github.com/NIFTI-Imaging/nifti_clib/pull/197","tags":[]}],"hasPoc":true,"ai":null}