AIKIDO-2026-950571

scipy is vulnerable to Memory Corruption

Memory Corruption Pre-CVE Published 3 days ago

Medium Risk

This Affects:

scipy

0.0.1 - 1.18.0

Fixed in 1.18.1

Are you affected? Scan for Free

TL;DR

SciPy 1.18.1 fixes several native memory-safety defects in C extension code. In _fitpackmodule.c, fitpack_sphere Py_XDECREFs borrowed ap_tt/ap_tp references on the error path when iopt == -1, fitpack_surfit can free wrk1/wrk2/iwrk twice if a later PyArray_SimpleNew fails, and fitpack_parcur double-DECREFs ap_t after the Fortran call if result allocation fails, causing use-after-free or double-free in SmoothSphereBivariateSpline, bisplrep, and splprep. DVODE/ZVODE callback thunks in _dzvodemodule.c pass an unchecked PyTuple_New result to PyTuple_SET_ITEM, so an allocation failure during scipy.integrate.ode segfaults. scipy.signal.remez writes past the end of the extremal-frequency arrays when a band is narrower than the dense grid. The patch INCREFs borrowed FITPACK references at assignment, NULLs freed work buffers, guards NULL tuples, and rejects too-narrow remez bands with ValueError.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use FITPACK interpolators (SmoothSphereBivariateSpline, bisplrep, or splprep), scipy.integrate.ode with the DVODE or ZVODE methods, or scipy.signal.remez with degenerate or attacker-controlled band edges.