CVE-2026-111125

CFITSIO versions through 4.7.0 are vulnerable to a heap-based out-of-bounds read in the HCOMPRESS tile decoder. The flaw exists in fits_hdecompress.c within the input_nnybble function, where a crafted FITS file using ZCMPTYPE HCOMPRESS_1 and oversized tile geometry can cause the application to re...