Heap-Based Out-of-Bounds Read in CFITSIO by HEASARC
CVE-2026-111124
6.9MEDIUM
What is CVE-2026-111124?
CFITSIO versions up to 4.7.0 are susceptible to a heap-based out-of-bounds read vulnerability located in the imcompress.c file. This issue arises when crafted FITS files are processed, particularly those utilizing a zero or negative ZDITHER0 seed. Attackers can exploit this flaw by submitting specially constructed FITS files with a SUBTRACTIVE_DITHER_1 compressed image. The vulnerability manifests during calls to fits_open_file() and fits_read_pix(), potentially leading to application crashes or the exposure of sensitive heap contents in the decoded pixel data.
Affected Version(s)
cfitsio 0 <= 4.7.0
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology