CVE-2026-111124: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compressed image, read through fitsopenfile() and fitsreadpix(), to cause crashes or leak heap contents in decoded pixels.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker must provide a crafted FITS file containing a SUBTRACTIVE_DITHER_1 compressed image with a zero or negative ZDITHER0 seed. The application must open and decode the image through fits_open_file() and fits_read_pix().
Which applications are realistically exposed?
Applications using CFITSIO through 4.7.0 are exposed when they process attacker-controlled FITS files and read pixels from affected compressed images. The issue is locally triggered according to the supplied vector, but no authentication or privileges are required before a user or application processes the malicious file.
What is the impact of successful exploitation?
The out-of-bounds read accesses memory before the fits_rand_value table. This can cause crashes or disclose heap contents through decoded pixel values.