CVE-2026-118590

NameCVE-2026-118590
DescriptionA security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nibabel (PTS)bookworm5.0.0-2vulnerable
trixie5.3.2-2vulnerable
forky, sid5.4.2-5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nibabelsource(unstable)(unfixed)

Notes

https://github.com/nipy/nibabel/issues/1566
https://github.com/nipy/nibabel/pull/1587

Search for package or bug name: Reporting problems