CVE-2026-111125: CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized tile geometry to crash applications calling fitsreadpix or disclose limited heap memory.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using CFITSIO through 4.7.0 are exposed when they read attacker-controlled FITS files containing HCOMPRESS_1-compressed image tiles. The vulnerable path is reached by calls such as fits_read_pix.
What does an attacker need to exploit it?
An attacker needs to provide a crafted FITS file with ZCMPTYPE set to HCOMPRESS_1 and oversized declared tile geometry. User interaction is required for the application to process the malicious file, while the attacker does not need privileges on the target system.
What is the likely impact if exploitation succeeds?
The out-of-bounds read can crash the application, causing denial of service. It may also disclose a limited amount of heap memory past the compressed tile buffer.