CFITSIO up to version 4.7.0 contains a heap‑based out‑of‑bounds read in the imcompress.c unquantize helpers. A crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and supplies a zero or negative ZDITHER0 seed allows an attacker to read memory preceding the protected fits_rand_value table when the library processes the file via fits_open_file() and fits_read_pix(). The read can expose arbitrary heap data from the hosting application and can also trigger crashes, compromising confidentiality and availability.

The vulnerability affects the CFITSIO library developed by HEASARC. All releases through 4.7.0 are impacted; subsequent releases that contain the patched code are safe. Systems that parse FITS images with CFITSIO, especially in astrophysical data processing pipelines, are at risk.

The CVSS v3.1 score of 6.9 indicates high‑moderate risk. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploitation yet. The likely attack vector is local, requiring an attacker to supply a malicious FITS file that the application processes. If an application runs with elevated privileges or in an untrusted context, the impact could include memory disclosure or denial of service.