nifti_clib CVE-2026-111275

Exploitation requires a victim application built on nifti_clib (through 3.0.1) to read an attacker-supplied, crafted 540-byte NIfTI-2 header file via nifti_image_read(), which reaches nifti_convert_n2hdr2nim() where dim[0] is never range-checked (patched to enforce 0-7). Key limiting factors: the vector is local/file-based (AV:L) and requires user interaction (UI:P) - the target must actively open or process the malicious file, so there is no remote network-triggered path; impact is predominantly denial-of-service (crash) with only limited integrity impact, and exposure is confined to software linking the vulnerable nifti_clib versions.

This is a memory-safety flaw (CWE-787, stack-based out-of-bounds read and write) in the niche neuroimaging library nifti_clib, driven by an unchecked NIfTI-2 dim[0] field in nifti_convert_n2hdr2nim(). The single CVSS 4.0 vector provided (6.9/Medium, AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) is internally consistent with the description: exploitation is local and file-driven, requires a victim to process a crafted file (UI:P), and yields primarily an availability impact (crash) with limited integrity impact and no confidentiality loss. No CVSS 3.1 vector, EPSS score, or SSVC decision point was supplied in the input, so automatability and widespread-exploitation probability cannot be quantified from the data. KEV status is not present in the input (treat as not listed), and no explicit POC/exploit-code flag was provided, though a detailed third-party technical writeup (hackmd) and a public issue/PR exist. Net assessment: this is a genuine but moderate-priority memory-corruption bug - real because a vendor patch and independent VulnCheck advisory confirm it, but bounded because it is local/file-triggered, needs user interaction, affects a specialized research library rather than ubiquitous infrastructure, and trends toward denial-of-service (A:H) rather than confirmed remote code execution.

An attacker crafts a malicious 540-byte NIfTI-2 header with an out-of-range dim[0] value and delivers it as a .nii file to a researcher or an automated neuroimaging pipeline. When the target application calls nifti_image_read() and the header is converted via nifti_convert_n2hdr2nim(), the unchecked dim[0] drives an out-of-bounds stack read/write, crashing the application or corrupting stack memory. No public exploit code is identified in the input, though a detailed technical writeup of the flaw is publicly available.