CVE-2026-111125

A flaw was found in cfitsio. A heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decompression logic allows an attacker who tricks a user or system into processing a crafted Flexible Image Transport System FITS file with oversized tile dimensions to read beyond allocated memory...

EUVD-2026-102356

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111125

CFITSIO versions through 4.7.0 are vulnerable to a heap-based out-of-bounds read in the HCOMPRESS tile decoder. The flaw exists in fits_hdecompress.c within the input_nnybble function, where a crafted FITS file using ZCMPTYPE HCOMPRESS_1 and oversized tile geometry can cause the application to re...