Nifti Clib
Monthly
Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.
Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.