EUVD-2026-102356
GHSA-98rm-rv63-xf58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft FITS file with oversized HCOMPRESS_1 tile
-
DeliveryDeliver to victim pipeline or user
-
ExploitApplication calls fits_read_pix on file
-
ExecutionTrigger OOB read in input_nnybble decoder
-
ImpactCrash application or leak heap memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application to parse an attacker-supplied FITS file whose compressed image uses ZCMPTYPE HCOMPRESS_1 with a crafted/oversized tile geometry, and specifically requires the vulnerable HCOMPRESS decompression path reached via a call to fits_read_pix (input_nnybble in fits_hdecompress.c). Limiting factors: this is a local/file-based vector (AV:L) requiring passive user or application interaction (UI:P) to open or process the malicious file - it cannot be triggered against a default service over the network without such file ingestion; it is confined to deployments that read HCOMPRESS-compressed FITS data through cfitsio versions up to and including 4.7.0. No authentication is required (PR:N), but a victim-side processing step is mandatory. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 (MEDIUM) and tells a consistent story: exploitation is NOT remote-network but file/local-vector based, requiring passive user interaction (UI:P) - i.e. an application or user must process an attacker-supplied FITS file. The primary impact is availability (VA:H, a crash) with only limited confidentiality loss (VC:L, bounded heap disclosure) and no integrity impact (VI:N), which matches CWE-125 (out-of-bounds READ). Public exploit code exists (confirmed by VulnCheck and a hackmd write-up), raising practical risk above a theoretical bug, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. Net: prioritize patching for environments that ingest untrusted FITS files via cfitsio's HCOMPRESS path, but this is not a wormable or server-side remote-code-execution crisis - it is a parser DoS with limited info-leak. Note a data caveat: the exploit reference URL is titled 'cfitsio-zdither0-dither-seed-oob-read,' which describes a different code path than the input_nnybble/HCOMPRESS decoder named in this CVE description - verify the POC actually targets this specific flaw before relying on it. |
| Exploit ScenarioDerived | An attacker crafts a malicious FITS file with ZCMPTYPE HCOMPRESS_1 that declares oversized tile geometry and delivers it to a victim (e.g. via a data-processing pipeline, email, or a public astronomical dataset). When an application built on cfitsio calls fits_read_pix to read the image, the HCOMPRESS tile decoder reads past the compressed tile buffer, crashing the application or disclosing a limited amount of adjacent heap memory. A public exploit/POC is available, lowering the barrier to triggering the condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based out-of-bounds read in the HCOMPRESS tile decoder of CFITSIO through 4.7.0 lets unauthenticated attackers trigger memory reads beyond the compressed tile buffer by supplying a crafted FITS file whose compressed image declares ZCMPTYPE HCOMPRESS_1 with oversized tile geometry; the flaw sits in the input_nnybble logic of fits_hdecompress.c and is reached through fits_read_pix. Impact is limited heap disclosure plus high availability loss - malformed reads can crash the consuming application - while confidentiality and integrity are only lightly affected (C:L, I:N per the source CVSS 4.0 vector, and assessed CVSS:3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Publicly available exploit code exists, so the practical barrier is low, but exploitation is file-based: a victim application must ingest and decompress the malicious FITS file, so the issue is a genuine but moderate-priority concern rather than a top-tier emergency.
RemediationAI
Patch status is not confirmed by the provided data: no fixed cfitsio release version appears in the advisory, references, or CPE information, and the linked GitHub material points to vulnerable source regions and upstream repository context rather than a tagged fix, so treat any upgrade to a release newer than 4.7.0 as unverified until HEASARC publishes an explicit advisory - monitor https://github.com/HEASARC/cfitsio and https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble for a patched version. Until a fix is confirmed, the most effective compensating control is to avoid decoding HCOMPRESS data from untrusted sources: reject or quarantine incoming FITS files whose headers declare ZCMPTYPE='HCOMPRESS_1' before they reach fits_read_pix, accepting the trade-off that legitimate HCOMPRESS-compressed astronomy data will be unusable through that path. Where HCOMPRESS ingestion is unavoidable, pre-validate the file header geometry - check that declared tile dimensions (ZTILE1/ZTILE2 and NAXIS1/NAXIS2) are internally consistent with the compressed data size and bounded by a sane maximum - and reject files that fail; this filtering must be implemented outside cfitsio because the vulnerable check is precisely the one being bypassed, and it adds parsing complexity that can itself be error-prone. Run any process that opens untrusted FITS files (batch converters, upload handlers, preview services) as a low-privilege account in a sandbox or container with memory limits and core-dump/ASLR hardening, so an out-of-bounds read terminates only the worker rather than exposing the host; this reduces, but does not eliminate, the limited heap-disclosure risk. Finally, since exploit code is publicly available, prioritize inventorying parsers that accept user-supplied FITS input and treat crash reports from fits_read_pix on HCOMPRESS files as a potential exploitation signal rather than a benign data-quality error.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CFITSIO is NASA HEASARC's reference C library for reading and writing FITS (Flexible Image Transport System) files, widely embedded in astronomy pipelines and in higher-level tools. HCOMPRESS is a tile-based FITS image compression convention (ZCMPTYPE='HCOMPRESS_1') built on an H-transform plus quantization and bit packing; the decoder reconstructs coefficients from a nibble-oriented bit stream. The vulnerable routine in fits_hdecompress.c (roughly lines 2575-2633) advances through that bit stream using an input_nnybble primitive, and the related header/tile bookkeeping lives in imcompress.c (roughly lines 6310-6316). Because the tile geometry (NAXIS1/NAXIS2 and per-tile dimensions) comes from the file itself, a crafted file can declare tile dimensions larger than the actual compressed payload, causing the decoder to index past the end of the allocated tile buffer - a classic heap out-of-bounds read (CWE-125), the same weakness class as many image-decoder parsing bugs. The consequence is bounded: data beyond the buffer boundary is interpreted as compressed coefficients, so the observable effects are incorrect pixel output/short reads of adjacent heap memory and, more reliably, memory-safety faults (segfaults, aborts) that terminate the calling process. The CPE cpe:2.3:a:heasarc:cfitsio:*:*:*:*:*:*:*:* indicates the entire catalogued version range is affected as reported, with the advisory bounding the issue at 4.7.0 and earlier. The bug is reachable only when HCOMPRESS-compressed data is actually decoded, most directly through fits_read_pix (and by extension higher-level wrappers that call it); code paths that read uncompressed images or other compression types are not implicated by this report.
Know when Cfitsio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
File-parsing flaw needs a victim to process a malicious FITS file (AV:L/UI:R) with no auth (PR:N), yielding a crash (A:H) and limited heap disclosure (C:L) but no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version
In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buf
In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buf
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a sta
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is re
CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted F
Exploit-DB