The vulnerability is an uncontrolled memory allocation and memory leak in the `_load_analyze()` routine of the CImg image processing library. Prior to version 4.0.0, the library reads the `header_size` field as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and uses it directly to allocate a new `unsigned char[header_size]` buffer without being bounded against the actual file size. A value up to ~4 GB is accepted. When the subsequent `fread` returns a short value—typically for any malformed file—the function throws a `CImgIOException` and the allocated buffer is never freed, leaking the full allocation on every error path. A six‑byte crafted file is sufficient to trigger an allocation of ~1.3 GB per call, with the allocation being leaked on each error. The issue is reachable via `load_analyze()` and the generic `load()` when the file extension is .hdr, .img, or .nii. Version 4.0.0 fixes the issue.

The flaw exists in the CImg image processing library supplied by GreycLab. All versions earlier than 4.0.0 are affected, including the common 3.x releases that many scientific and medical imaging applications rely upon. The issue is triggered by calls to `load_analyze()` or the generic `load()` function when handling files with .hdr, .img, or .nii extensions. Version 4.0.0 and later contain a boxed allocation guard that prevents the over-allocation.

The CVSS score of 7.5 indicates a high‑severity impact. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, implying a low to moderate exploitation probability under current threat information. Attackers would need to supply a crafted Analyze/NIfTI file, either locally or via an application that processes user‑supplied imaging data. In a local context the impact is direct memory exhaustion leading to a crash or denial of service; in a remote setting an application that uses CImg in a privileged or network‑exposed role could be affected if it accepts untrusted files. No privilege escalation or code execution paths are evident from the description.