Live › vulnerability › CVE-2026-115504
Go to dashboardCFITSIO through 4.7.0 has an out-of-bounds write in ffgcls2() in getcols.c, which trusts heap descriptor lengths for variable-length string columns. A crafted FITS file overflows a fixed stack buffer and the caller's string array, which the sources say enables arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Programs that link CFITSIO 4.7.0 or earlier and read FITS files that an outsider could supply, such as astronomy pipelines, image viewers or web services that process uploaded FITS data. The sources do not say whether ffgcls2() is reached by default in every build, so teams that only process their own trusted files are less exposed. Teams not using CFITSIO can skip it.
No product ranges from the sources yet.
4.7.0 or earlier in your dependency manifests or build files; the sources do not give a command)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-115504")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.