CVE-2026-118590— nipy nibabel Header volumeutils.py array_from_file memory allocation

Quick assessment

Affected

nipy nibabel

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 nipy 项目的 nibabel 库（版本 5.4.2 及更早版本）中发现了一个安全漏洞。受影响的组件是 Header Handler，具体位于文件中的函数。该漏洞允许攻击者通过恶意操作引发不受控制的内存分配。此攻击可远程实施。目前，用于修复该问题的拉取请求（Pull Request）正在等待审核通过。

CVSS 5.3 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

nipy nibabel Header volumeutils.py array_from_file memory allocation

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

未经控制的内存分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nipy	nibabel	5.4.0	`cpe:2.3:a:nipy:nibabel::::::::`

II. Public POCs for CVE-2026-118590

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118590

请登录查看更多情报信息。

Other References for CVE-2026-118590 (7)

https://github.com/nipy/nibabel/ product
https://github.com/nipy/nibabel/pull/1587 issue-tracking patch
https://github.com/nipy/nibabel/issues/1566 issue-tracking
https://vuldb.com/cve/CVE-2026-118590 third-party-advisory
https://vuldb.com/vuln/428028/cti signature permissions-required
https://vuldb.com/submit/1026208 third-party-advisory
https://vuldb.com/vuln/428028 vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-118590

IV. Related Vulnerabilities

Same weakness: CWE-789