CVE-2026-111125 - Vulnerability Details

- CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

Description

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

Published: 2026-10-15

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a heap-based out‑of‑bounds read in the HCOMPRESS tile decoder of CFITSIO. When a crafted FITS file declares an oversized tile geometry for the HCOMPRESS_1 type, the decoder reads past the allocated buffer via the input_nnybble parameter. This can cause the application to crash or reveal a small portion of adjacent heap memory. The weakness corresponds to CWE‑125.

Affected Systems

The issue applies to the HEASARC CFITSIO library versions up to and including 4.7.0. Any software that links against CFITSIO 4.7.0 or earlier and processes FITS files containing HCOMPRESS_1 tiles is potentially impacted. No other vendors or product lines are listed by the CNA for this vulnerability.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation is known. Attackers would need to supply a malicious FITS file that is read by the vulnerable CFITSIO decoder. The impact could be application crash or limited disclosure of adjacent heap memory. Because the read is limited to a small region, the damage scope is modest.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HEASARC

cfitsio

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.7.0

Configuration 1 [-]

cpe:2.3:a:nasa:cfitsio:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Heasarc

Cfitsio

100%

Version	Status	Scheme	Platform
`[0,4.7.0]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any patch released by CFITSIO or update to the latest available release to address the out‑of‑bounds read.
If an upgrade is not possible, add strict validation of tile geometry sizes in the application before calling fits_read_pix so that input_nnybble never exceeds buffer bounds.
As a temporary containment measure, block processing of FITS files from untrusted sources or run the reader inside a sandboxed environment to isolate potential crashes.

Generated by OpenCVE AI on October 16, 2026 at 16:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00245.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/HEASARC/cfitsio
https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/fits_hdecompress.c#L2575-L2633
https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L6310-L6316
https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read
https://nvd.nist.gov/vuln/detail/CVE-2026-111125
https://www.cve.org/CVERecord?id=CVE-2026-111125
https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble

History

Wed, 21 Oct 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Heasarc Heasarc cfitsio
Vendors & Products		Heasarc Heasarc cfitsio

Wed, 21 Oct 2026 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nasa Nasa cfitsio
CPEs		cpe:2.3:a:nasa:cfitsio::::::::
Vendors & Products		Nasa Nasa cfitsio

Fri, 16 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-111125 https://www.cve.org/CVERecord?id=CVE-2026-111125
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 15 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Title		CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble
Weaknesses		CWE-125
References		https://github.com/HEASARC/cfitsio https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/fits_hdecompress.c#L2575-L2633 https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L6310-L6316 https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Heasarc Cfitsio

Nasa Cfitsio

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-15T18:57:22.035Z

Updated: 2026-10-21T01:15:29.785Z

Reserved: 2026-10-15T17:03:51.157Z

Link: CVE-2026-111125

Vulnrichment

Updated: 2026-10-21T01:15:20.786Z

NVD

Status : Analyzed

Published: 2026-10-15T19:17:25.780

Modified: 2026-10-21T02:17:03.647

Link: CVE-2026-111125

Redhat

Severity : Moderate

Publid Date: 2026-10-15T18:57:22Z

Links: CVE-2026-111125 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-21T20:22:50Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object