CVE-2026-115504
CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
| CWE | CWE-787 |
| Vendor | heasarc |
| Product | cfitsio |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for heasarc cfitsio
Be the first to know when new high vulnerabilities affecting heasarc cfitsio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
HEASARC / cfitsio
0 ≤ 4.7.0
References
gist.github.com: https://gist.github.com/yure1432/98f15c7e8f48dc90ae65646f926aa176 github.com: https://github.com/HEASARC/cfitsio/pull/184 github.com: https://github.com/HEASARC/cfitsio/commit/579792e0f85bff0c6733ad5ebdf54c3b5c188686 github.com: https://github.com/HEASARC/cfitsio vulncheck.com: https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-out-of-bounds-write-via-ffgcls2-in-getcols-c
Credits
Pratyaksh Srivats