CFITSIO EUVD-2026-108336

Exploitation requires that an application using CFITSIO (<= 4.7.0) read a variable-length string column (TFORM '1PA'/variable-length array) from an attacker-controlled FITS file, where the heap descriptor length field exceeds the 28,800-byte cbuff stack buffer; the pre-patch bounds check could be bypassed because ntodo*twidth could integer-overflow. Reaching the vulnerable ffgcls2() path requires the victim to open and read that specific column via the library (UI:P - passive user interaction). Limiting factors: no network vector (AV:L - the malicious file must be processed locally), exploitation is gated on the target application actually parsing variable-length string columns, and the affected product is a scientific library rather than a network-facing service. No privileges or authentication are required beyond getting the victim to process the file.

Severity signals are moderate-to-high and internally consistent. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) correctly models this as a client-side file-parsing flaw: exploitation is local and requires a victim to process an attacker-supplied FITS file, not a remotely reachable service - so despite CWE-787 out-of-bounds write and VC/VI/VA:H (plausible RCE), this is not a wormable network bug. The vuln.today Decision label is 'this_week' (not act_now/emergency), aligning with that profile. Exploitation status: a public PoC reference exists (a GitHub gist), but it is not verified as working exploit code; the flaw is NOT in CISA KEV and there is no confirmed active exploitation. No EPSS score is provided in the input, so probabilistic exploitation likelihood cannot be quantified here - STATE EXPLICITLY: EPSS is missing. The source diff confirms the mechanism (an integer-overflow-prone bounds check, ntodo*twidth > sizeof(cbuff), was replaced with an overflow-safe division check), which raises confidence this is a real, patchable memory-corruption bug rather than a theoretical one. Net: a genuine high-severity library vulnerability warranting prompt patching for anyone processing untrusted FITS files, but lower real-world urgency than a network-exploitable CVE because it depends on local file handling and user interaction.

An attacker crafts a malicious FITS file containing a variable-length string column ('1PA') whose heap descriptor advertises a length exceeding the fixed 28,800-byte stack buffer, then delivers it to a victim (e.g., as an astronomical dataset). When the victim opens or processes the file with any application linked against CFITSIO and reads that column (e.g., via ffgcvs/ffgcls2), the oversized descriptor is trusted and overflows the stack buffer and the caller's string array, enabling arbitrary code execution. A public PoC reference (gist) exists but is not verified as working exploit code.