AIKIDO-2026-125890

numpy is vulnerable to Stack-based Buffer Overflow

Stack-based Buffer Overflow Pre-CVE Published 3 days ago

Low Risk

This Affects:

numpy

1.20.0 - 2.5.1

Fixed in 2.5.2

Are you affected? Scan for Free

TL;DR

NumPy's npy__cpu_check_env parses NPY_ENABLE_CPU_FEATURES and NPY_DISABLE_CPU_FEATURES during import and copies unrecognized or unsupported feature names into stack diagnostic buffers. An accepted maximum-length environment value can write a terminating NUL one byte past the nexist buffer, and repeating unsupported dispatched feature names can overflow the smaller notsupp buffer, which was sized from NPY_WITH_CPU_DISPATCH rather than the accepted environment-variable length. Those out-of-bounds writes corrupt stack memory and can crash the process. The fix sizes both diagnostic buffers from the accepted input length and avoids the trailing-space-and-trim pattern.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your process imports NumPy with attacker-influenced NPY_ENABLE_CPU_FEATURES or NPY_DISABLE_CPU_FEATURES environment variables.