NASA CFITSIO: Out-of-bounds write in getcols.c (CVE-2026-115504)
A vulnerability in CFITSIO up to version 4.7.0 allows for arbitrary code execution through an out-of-bounds write in the ffgcls2 function when processing maliciously crafted FITS files.
CVE search metadata
CVE search record: CVE-2026-115504. Severity: high. CVSS: 7.8. KEV: no. Product: CFITSIO (<= 4.7.0). Brief: NASA CFITSIO: Out-of-bounds write in getcols.c (CVE-2026-115504). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cfitsio-oob-write/
Triage facts
Revision 1- Applicability
- CFITSIO (<= 4.7.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 22:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
CFITSIO version 4.7.0 and earlier contains an out-of-bounds write vulnerability in the ffgcls2() function located in getcols.c. The vulnerability arises because the library trusts attacker-controlled heap descriptor lengths for variable-length string columns. A crafted FITS file can trigger an overflow of a fixed 28,800-byte stack buffer, potentially leading to arbitrary code execution in the context of the application parsing the file.
Impact
Successful exploitation allows an attacker to achieve arbitrary code execution on systems that process malicious FITS files using the affected CFITSIO library.
Recommendation
- Inventory systems and software applications within the environment that utilize the CFITSIO library for FITS file processing.
- Prioritize updates to the latest version of CFITSIO once the vendor releases a patch addressing CVE-2026-115504.
- Implement file format validation or utilize sandboxing when processing untrusted FITS files until the library can be updated.
Immediate actions
Inventory software dependencies for libraries using CFITSIO <= 4.7.0
Mitigations
Upgrade CFITSIO to a version later than 4.7.0 once patches are available
CVE-2026-115504