Cfitsio
Monthly
Out-of-bounds write in CFITSIO through 4.7.0 lets a crafted FITS file overflow both a fixed 28,800-byte stack buffer (cbuff) and the caller's string array when an application reads a variable-length string column, opening the door to arbitrary code execution in the victim process. The vulnerable path is ffgcls2() in getcols.c, which trusts heap-descriptor length values taken from the file instead of validating them against the destination buffer size. Exploitation is local in vector terms (CVSS:4.0/AV:L, CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the target application to actually parse a variable-length string column ('1PA'-style TFORM) from the file; no privileges are needed beyond inducing the victim to open the FITS file. A public PoC reference (a gist cited in the CVE record) exists but is not verified as working exploit code, EPSS/KEV data is absent, and the vendor has published an upstream fix in PR #184 (commit 579792e0f85bff0c6733ad5ebdf54c3b5c188686), which the vuln.today decision logic labels this_week.
Heap-based out-of-bounds read in the HCOMPRESS tile decoder of CFITSIO through 4.7.0 lets unauthenticated attackers trigger memory reads beyond the compressed tile buffer by supplying a crafted FITS file whose compressed image declares ZCMPTYPE HCOMPRESS_1 with oversized tile geometry; the flaw sits in the input_nnybble logic of fits_hdecompress.c and is reached through fits_read_pix. Impact is limited heap disclosure plus high availability loss - malformed reads can crash the consuming application - while confidentiality and integrity are only lightly affected (C:L, I:N per the source CVSS 4.0 vector, and assessed CVSS:3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Publicly available exploit code exists, so the practical barrier is low, but exploitation is file-based: a victim application must ingest and decompress the malicious FITS file, so the issue is a genuine but moderate-priority concern rather than a top-tier emergency.
CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and sets the ZDITHER0 seed to zero or a negative value. Triggering the bug requires local access and user interaction to open the file and decode pixels, resulting in a crash (denial of service) and a limited, non-targeted leak of heap memory into decoded pixel values. No public exploit code or active exploitation has been identified, and the issue is best characterized as a moderate-priority file-parsing bug rather than a remote code execution threat.
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds write in CFITSIO through 4.7.0 lets a crafted FITS file overflow both a fixed 28,800-byte stack buffer (cbuff) and the caller's string array when an application reads a variable-length string column, opening the door to arbitrary code execution in the victim process. The vulnerable path is ffgcls2() in getcols.c, which trusts heap-descriptor length values taken from the file instead of validating them against the destination buffer size. Exploitation is local in vector terms (CVSS:4.0/AV:L, CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the target application to actually parse a variable-length string column ('1PA'-style TFORM) from the file; no privileges are needed beyond inducing the victim to open the FITS file. A public PoC reference (a gist cited in the CVE record) exists but is not verified as working exploit code, EPSS/KEV data is absent, and the vendor has published an upstream fix in PR #184 (commit 579792e0f85bff0c6733ad5ebdf54c3b5c188686), which the vuln.today decision logic labels this_week.
Heap-based out-of-bounds read in the HCOMPRESS tile decoder of CFITSIO through 4.7.0 lets unauthenticated attackers trigger memory reads beyond the compressed tile buffer by supplying a crafted FITS file whose compressed image declares ZCMPTYPE HCOMPRESS_1 with oversized tile geometry; the flaw sits in the input_nnybble logic of fits_hdecompress.c and is reached through fits_read_pix. Impact is limited heap disclosure plus high availability loss - malformed reads can crash the consuming application - while confidentiality and integrity are only lightly affected (C:L, I:N per the source CVSS 4.0 vector, and assessed CVSS:3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Publicly available exploit code exists, so the practical barrier is low, but exploitation is file-based: a victim application must ingest and decompress the malicious FITS file, so the issue is a genuine but moderate-priority concern rather than a top-tier emergency.
CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and sets the ZDITHER0 seed to zero or a negative value. Triggering the bug requires local access and user interaction to open the file and decode pixels, resulting in a crash (denial of service) and a limited, non-targeted leak of heap memory into decoded pixel values. No public exploit code or active exploitation has been identified, and the issue is best characterized as a moderate-priority file-parsing bug rather than a remote code execution threat.
NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.