| Title | nipy nibabel 5.4.2 Uncontrolled Memory Allocation |
|---|
| Description | nibabel up to 5.4.2 is affected by uncontrolled memory allocation leading to denial of service. The array_from_file routine allocates a buffer sized as the product of the image dimensions multiplied by the item size, taken from the attacker-controlled NIfTI header, before validating those values against the actual file size (nibabel/volumeutils.py around line 463). A tiny crafted file can declare large dimensions and force an enormous allocation. Runtime verified against the latest release: a 352-byte crafted file drives an allocation of about 8.59 GB, enough to crash or hang any service that parses untrusted NIfTI input. CWE-789. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5. Suggested fix: validate declared dimensions against the remaining file size before allocating. |
|---|
| Source | ⚠️ https://github.com/nipy/nibabel/issues/1566 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 20:42 (17 days ago) |
|---|
| Moderation | 10/28/2026 17:19 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 428028 [nipy nibabel up to 5.4.2 Header nibabel/volumeutils.py array_from_file memory allocation] |
|---|
| Points | 20 |
|---|