CFITSIO EUVD-2026-102355

Exploitation requires an attacker-supplied FITS file containing a tile-compressed image that uses SUBTRACTIVE_DITHER_1 dithering with the ZDITHER0 header keyword set to zero or a negative value, and the victim application must actually decode pixels - i.e., call fits_open_file() followed by fits_read_pix() (or an equivalent read path) against that file. Limiting factors that reduce real-world risk: the vector is LOCAL (AV:L) and demands passive user interaction (UI:P) - the victim must open/process the malicious file; the bug only triggers for the specific SUBTRACTIVE_DITHER_1 compression mode combined with the crafted non-positive seed, not for arbitrary or uncompressed FITS data; and the primary outcome is a crash (DoS) with only a limited, non-targeted heap leak surfacing inside decoded pixel values. Affected products are CFITSIO builds through 4.7.0.

This is a genuine but moderate-priority issue, best characterized as a file-parsing (DoS plus limited info-leak) bug rather than a remote code execution threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) confirms the attack is LOCAL and requires PASSIVE user interaction - a victim must open or process an attacker-supplied FITS file - so there is no network-facing, unauthenticated mass-exploitation path despite PR:N. The dominant impact is availability (VA:H, crashes) with only low confidentiality loss (VC:L, heap bytes bleeding into decoded pixels) and no integrity impact (VI:N), consistent with CWE-125 out-of-bounds READ (no memory corruption/write). No EPSS score or CISA KEV status was provided in the input, and there is no explicit POC/exploit flag; a detailed third-party technical write-up (hackmd) and a VulnCheck advisory with exact vulnerable source lines exist, which lowers the research bar but does not constitute confirmed weaponized exploit code. Net: real and worth patching in any pipeline that ingests untrusted FITS files, but the local vector, required user interaction, and read-only (non-RCE) impact keep it well below a drop-everything priority. Note the signal interaction: a 6.9/MEDIUM score with AV:L+UI:P but PR:N can read as more severe than it operates in practice - the user-interaction and local-file prerequisites are the true risk limiters.

An attacker distributes a malicious FITS image (e.g., via a data-sharing portal, email attachment, or automated astronomy data pipeline) containing a SUBTRACTIVE_DITHER_1 tile-compressed image with a ZDITHER0 dither seed set to zero or a negative value. When a victim's application opens the file with fits_open_file() and decodes pixels with fits_read_pix(), the unquantize helper indexes before the fits_rand_value table, reading out-of-bounds heap memory. This crashes the process or leaks adjacent heap bytes into the returned pixel values; no public weaponized exploit is identified, though a detailed technical write-up documents the exact code path.