CVE-2026-115504
HighCVSS 7.8Summary
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
Risk Assessment
Processing a malicious FITS file may lead to buffer overflow and arbitrary code execution in the context of the application parsing the data. The risk affects systems analyzing untrusted FITS files, e.g., in astronomy or scientific data processing.
Recommendation
Update CFITSIO to a version later than 4.7.0 once a fix is available. Until then, avoid processing untrusted FITS files or do so in an isolated environment.
Other vulnerabilities in CFITSIO
See all- CVE-2026-111125Medium
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
- CVE-2026-111124Medium
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
Original NVD description (English source)
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS