CFITSIO 4.7.0 and earlier contain an out‑of‑bounds write in the ffgcls2 function located in getcols.c; the function trusts heap descriptor lengths supplied by the FITS file creator for variable‑length string columns. An attacker can craft a FITS file that overflows a 28,800‑byte stack buffer and the caller’s string array, enabling arbitrary code execution. This defect is a classic out‑of‑bounds write (CWE‑787).

Any system or application that links against CFITSIO 4.7.0 or older and processes FITS files from external or untrusted sources is affected, including scientific data tools, astrophysics pipelines and custom consumer code that uses the library.

The CVSS score of 8.5 marks this vulnerability as high severity. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the ability for a remote attacker to execute arbitrary code by delivering a malicious FITS file remains a serious risk. The attack path is straightforward once the vulnerable library processes an unpatched file.