CVE-2026-111275 in nifti_clib
Summary
by MITRE • 10/16/2026
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in nifti_clib versions through 3.0.1 represents a critical security flaw within the library's handling of NIfTI-2 image headers, specifically located in the function nifti_convert_n2hdr2nim(). This component is responsible for converting NIfTI-2 header data structures into internal representations used by the application. The core technical deficiency lies in the absence of range validation for the dim[0] field within the NIfTI-2 header structure. In standard image processing workflows, this dimension parameter dictates the number of dimensions and often influences memory allocation or array indexing operations during subsequent processing steps. Because the library fails to verify that the value provided by an attacker falls within expected bounds, it proceeds with unsafe memory access patterns based on untrusted input data.
This lack of validation leads directly to a stack-based out-of-bounds read and write vulnerability. When an application utilizes nifti_image_read() to process a maliciously crafted NIfTI-2 file containing a header size or dimension configuration that exploits this flaw, the library may attempt to access memory locations outside the allocated stack frame. The specific attack vector involves supplying a carefully constructed 540-byte NIfTI-2 header designed to trigger these out-of-bounds accesses. Depending on the exact execution path and compiler optimizations, an attacker can either read sensitive data from adjacent stack memory or overwrite critical return addresses and local variables. This behavior is characteristic of classic buffer overflow vulnerabilities where input validation is neglected during the parsing of complex binary formats.
The operational impact of this vulnerability is severe for any software that relies on nifti_clib to load medical imaging files. An attacker who can trick a user into opening a malicious NIfTI-2 file could cause the application to crash, resulting in a denial of service condition. More critically, if the out-of-bounds write allows control over execution flow, it enables arbitrary code execution on the victim's system. This poses significant risks in clinical and research environments where medical imaging software is frequently used with data from various sources that may not be fully trusted or verified for integrity prior to processing. The ability to corrupt stack memory undermines the fundamental security guarantees of modern operating systems, potentially leading to full system compromise if exploited alongside other vulnerabilities such as those mitigated by ASLR or DEP protections.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, reflecting the unsafe memory operations resulting from insufficient input validation. In terms of attack tactics, it corresponds to MITRE ATT&CK techniques related to initial access via malicious files and potential privilege escalation if stack corruption leads to code execution. To mitigate this risk, developers must immediately update nifti_clib to a version greater than 3.0.1 where the dim[0] value is properly range-checked before being used in memory operations. Additionally, applications integrating this library should implement defense-in-depth strategies such as input sanitization at the application layer and enabling compiler security features like stack canaries and address space layout randomization to reduce the likelihood of successful exploitation even if vulnerable code paths are encountered.