CVE-2026-118590 nipy nibabel Header volumeutils.py array_from_file memory allocation

Medium 6.9 Published 29 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118590?

CVE-2026-118590 is a medium-severity vulnerability in nipy nibabel, published on 29 Oct 2026.

Official description

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

Weakness: CWE-789, CWE-400

Which versions are affected by CVE-2026-118590?

How do I fix CVE-2026-118590?

No fix has been published for CVE-2026-118590 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118590 being exploited?

There is no known exploitation of CVE-2026-118590 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-118590, GHSA-5v4h-cwmw-rr9x, UBUNTU-CVE-2026-118590.