CVE-2026-115504: CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must cause CFITSIO to process a crafted FITS file containing variable-length string columns with attacker-controlled heap descriptor lengths. The published vector indicates local attack access, no privileges required, and user interaction required.
Who is most exposed?
Systems or applications that use CFITSIO to open or process FITS files from untrusted sources are exposed, particularly where a user can be induced to load an attacker-supplied file. The impact can include arbitrary code execution through an out-of-bounds write.
How can I tell whether my deployment is affected?
Check whether the application uses CFITSIO through version 4.7.0 and processes FITS files with variable-length string columns. The vulnerable code path is ffgcls2() in getcols.c.