EUVD-2026-102530
GHSA-jj37-jg79-p9qw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted 540-byte NIfTI-2 file
-
DeliveryVictim opens file in nifti_clib app
-
ExploitUnchecked dim[0] in nifti_convert_n2hdr2nim
-
ExecutionOut-of-bounds stack read/write
-
ImpactApplication crash or stack corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim application built on nifti_clib (through 3.0.1) to read an attacker-supplied, crafted 540-byte NIfTI-2 header file via nifti_image_read(), which reaches nifti_convert_n2hdr2nim() where dim[0] is never range-checked (patched to enforce 0-7). Key limiting factors: the vector is local/file-based (AV:L) and requires user interaction (UI:P) - the target must actively open or process the malicious file, so there is no remote network-triggered path; impact is predominantly denial-of-service (crash) with only limited integrity impact, and exposure is confined to software linking the vulnerable nifti_clib versions. |
| Impact | This is a memory-safety flaw (CWE-787, stack-based out-of-bounds read and write) in the niche neuroimaging library nifti_clib, driven by an unchecked NIfTI-2 dim[0] field in nifti_convert_n2hdr2nim(). The single CVSS 4.0 vector provided (6.9/Medium, AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) is internally consistent with the description: exploitation is local and file-driven, requires a victim to process a crafted file (UI:P), and yields primarily an availability impact (crash) with limited integrity impact and no confidentiality loss. No CVSS 3.1 vector, EPSS score, or SSVC decision point was supplied in the input, so automatability and widespread-exploitation probability cannot be quantified from the data. KEV status is not present in the input (treat as not listed), and no explicit POC/exploit-code flag was provided, though a detailed third-party technical writeup (hackmd) and a public issue/PR exist. Net assessment: this is a genuine but moderate-priority memory-corruption bug - real because a vendor patch and independent VulnCheck advisory confirm it, but bounded because it is local/file-triggered, needs user interaction, affects a specialized research library rather than ubiquitous infrastructure, and trends toward denial-of-service (A:H) rather than confirmed remote code execution. |
| Exploit ScenarioDerived | An attacker crafts a malicious 540-byte NIfTI-2 header with an out-of-range dim[0] value and delivers it as a .nii file to a researcher or an automated neuroimaging pipeline. When the target application calls nifti_image_read() and the header is converted via nifti_convert_n2hdr2nim(), the unchecked dim[0] drives an out-of-bounds stack read/write, crashing the application or corrupting stack memory. No public exploit code is identified in the input, though a detailed technical writeup of the flaw is publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.
RemediationAI
Patch available per vendor advisory; the upstream fix is in PR #197 (https://github.com/NIFTI-Imaging/nifti_clib/pull/197), which adds the missing dim[0] range check (0-7) in nifti_convert_n2hdr2nim() and rejects malformed headers - upstream fix available (PR/commit); a released patched version number is not independently confirmed, so verify your distribution's backport rather than assuming a tagged release. Until the fix is deployed, treat untrusted NIfTI-2 files as hostile: gate the parser, rejecting any 540-byte NIfTI-2 header whose dim[0] is negative or greater than 7 in the calling application before invoking nifti_image_read(), which stops the trigger at the cost of duplicating validation logic outside the library; process untrusted volumes in a sandboxed, resource-limited worker process so a crash or stack corruption cannot affect the host workflow, at the cost of added orchestration overhead; and, where NIfTI-2 input is not required, refuse NIfTI-2 headers outright and accept only NIfTI-1 files - effective, but it breaks any legitimate NIfTI-2 datasets. There is no configuration flag inside nifti_clib that disables the vulnerable conversion independent of the patch, so the upstream fix should be treated as the only complete remediation. Rebuild every application that statically links nifti_clib after applying the fix, since replacing a shared library alone will not cover embedded copies. Reference material: https://hackmd.io/@haind-pwn/nifticlib-nifti2-dim0-oob and https://github.com/NIFTI-Imaging/nifti_clib/issues/195.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
nifti_clib is a C library for reading and writing NIfTI neuroimaging files, used by tools such as FSL, AFNI-adjacent utilities and custom analysis pipelines. NIfTI-2 files begin with a fixed 540-byte header that includes the dim[] array, where dim[0] declares how many of the following dim[1..7] entries are meaningful. In nifti_convert_n2hdr2nim() (nifti2/nifti2_io.c), the code copies header dimension fields into the in-memory nifti_image structure using dim[0] as a loop/array bound without validating it, so a negative or greater-than-7 value drives reads and writes past the end of a stack buffer - the CWE-787 out-of-bounds write class, compounded here by an out-of-bounds read. Because the header length is fixed and attacker-controllable, the malformed value survives parsing until it reaches this conversion routine. The vendor fix (PR #197) adds an explicit guard accepting only 0 <= nhdr.dim[0] <= 7, freeing the allocated nifti_image and returning an error via ERREX("bad dim[0]") for anything outside that range.
Know when Nifti Clib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
File must be opened locally by the victim, so AV:L and UI:R; no auth needed (PR:N); crash dominates (A:H) with limited stack-corruption integrity impact (I:L) and no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB