CVE-2026-111124

The CFITSIO library (versions through 4.7.0 ) is vulnerable to a heap-based out-of-bounds read in the imcompress.c unquantize helpers. An attacker can provide a crafted FITS file containing a SUBTRACTIVE_DITHER_1 compressed image with a zero or negative ZDITHER0 seed. Processing this file via fit...