CVE-2026-115504

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

SUSE CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

SUSE CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

UBUNTU-CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

Linux Distros Unpatched Vulnerability : CVE-2026-111124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before...

Linux Distros Unpatched Vulnerability : CVE-2026-111125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed til...

UBUNTU-CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111125

A flaw was found in cfitsio. A heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decompression logic allows an attacker who tricks a user or system into processing a crafted Flexible Image Transport System FITS file with oversized tile dimensions to read beyond allocated memory...

CVE-2026-111124

A flaw was found in cfitsio. An attacker could exploit this vulnerability by supplying a specially crafted Flexible Image Transport System FITS file containing compressed image data with invalid dither parameters. When processed by an application using the library, this flaw triggers an...

DEBIAN-CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

DEBIAN-CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125

Versions of CFITSIO through 4.7.0 are affected by a heap-based out-of-bounds read vulnerability within the HCOMPRESS tile decoder . The root cause is located in fits_hdecompress.c, where the input_nnybble function fails to properly handle input, allowing attackers to read past the compressed tile...

CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

EUVD-2026-102356

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111124

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...