CVE-2026-118590

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118590", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-28T16:19:42.890Z", "datePublished": "2026-10-29T00:00:21.707Z", "dateUpdated": "2026-11-04T01:09:13.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-29T00:00:21.707Z"}, "title": "nipy nibabel Header volumeutils.py array_from_file memory allocation", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-789", "lang": "en", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}], "affected": [{"vendor": "nipy", "product": "nibabel", "versions": [{"version": "5.4.0", "status": "affected"}, {"version": "5.4.1", "status": "affected"}, {"version": "5.4.2", "status": "affected"}], "cpes": ["cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"], "modules": ["Header Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "timeline": [{"time": "2026-10-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-28T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-28T17:24:47.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Mohammedix88 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/428028", "name": "VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory allocation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/428028/cti", "name": "VDB-428028 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-118590", "name": "CVE-2026-118590 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026208", "name": "Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nipy/nibabel/issues/1566", "tags": ["issue-tracking"]}, {"url": "https://github.com/nipy/nibabel/pull/1587", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nipy/nibabel/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T01:09:00.738918Z", "id": "CVE-2026-118590", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:09:13.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118590", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T01:09:00.738918Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:09:07.162Z"}}], "cna": {"title": "nipy nibabel Header volumeutils.py array_from_file memory allocation", "credits": [{"lang": "en", "type": "reporter", "value": "Mohammedix88 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"], "vendor": "nipy", "modules": ["Header Handler"], "product": "nibabel", "versions": [{"status": "affected", "version": "5.4.0"}, {"status": "affected", "version": "5.4.1"}, {"status": "affected", "version": "5.4.2"}]}], "timeline": [{"lang": "en", "time": "2026-10-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-28T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-28T17:24:47.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/428028", "name": "VDB-428028 | nipy nibabel Header volumeutils.py array_from_file memory allocation", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/428028/cti", "name": "VDB-428028 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-118590", "name": "CVE-2026-118590 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1026208", "name": "Submit #1026208 | nipy nibabel 5.4.2 Uncontrolled Memory Allocation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/nipy/nibabel/issues/1566", "tags": ["issue-tracking"]}, {"url": "https://github.com/nipy/nibabel/pull/1587", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nipy/nibabel/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "Uncontrolled Memory Allocation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-29T00:00:21.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118590", "state": "PUBLISHED", "dateUpdated": "2026-11-04T01:09:13.497Z", "dateReserved": "2026-10-28T16:19:42.890Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-29T00:00:21.707Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"], "modules": ["Header Handler"], "product": "nibabel", "vendor": "nipy", "versions": [{"status": "affected", "version": "5.4.0"}, {"status": "affected", "version": "5.4.1"}, {"status": "affected", "version": "5.4.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."}], "id": "CVE-2026-118590", "lastModified": "2026-11-04T01:17:22.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118590", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T01:09:00.738918Z", "version": "2.0.3"}}]}, "published": "2026-10-29T01:17:22.900", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/nipy/nibabel/"}, {"source": "cna@vuldb.com", "url": "https://github.com/nipy/nibabel/issues/1566"}, {"source": "cna@vuldb.com", "url": "https://github.com/nipy/nibabel/pull/1587"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-118590"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1026208"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/428028"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/428028/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nibabel: nibabel: Denial of Service via uncontrolled memory allocation", "id": "2563245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563245"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.", "A flaw was found in nibabel. The header processing logic in the array_from_file function does not properly restrict memory allocation when handling input data. A remote attacker could exploit this vulnerability by submitting a specially crafted file to trigger excessive memory consumption, leading to a Denial of Service (DoS)."], "name": "CVE-2026-118590", "public_date": "2026-10-29T00:00:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118590\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118590\nhttps://github.com/nipy/nibabel/\nhttps://github.com/nipy/nibabel/issues/1566\nhttps://github.com/nipy/nibabel/pull/1587\nhttps://vuldb.com/cve/CVE-2026-118590\nhttps://vuldb.com/submit/1026208\nhttps://vuldb.com/vuln/428028\nhttps://vuldb.com/vuln/428028/cti"], "statement": "This vulnerability is rated as Moderate severity for Red Hat because exploitation is limited to a denial of service through memory exhaustion, requiring an application to parse an untrusted or maliciously crafted neuroimaging file. While excessive memory consumption can terminate the processing application or cause resource starvation on the host, the flaw does not allow remote code execution or unauthorized data modification. Furthermore, nibabel is a specialized scientific library not deployed as part of core enterprise services, confining the blast radius to workflows that ingest unvalidated user files.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nibabel", "source": "cna", "vendor": "nipy"}, "product": "nibabel", "vendor": "nipy"}], "created": "2026-10-29T02:00:16.689834+00:00", "updated": "2026-11-06T02:15:18.142470+00:00", "vendors": ["nipy", "nipy$PRODUCT$nibabel"]}