{"id":"CVE-2026-115504","kind":"vulnerability","aliases":["CVE-2026-115504"],"related":[],"title":"CFITSIO: crafted FITS file overflows buffer in ffgcls2, enabling code execution","description":"CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.","summary":"CFITSIO through 4.7.0 has an out-of-bounds write in ffgcls2() in getcols.c, which trusts heap descriptor lengths for variable-length string columns. A crafted FITS file overflows a fixed stack buffer and the caller's string array, which the sources say enables arbitrary code execution.","severity":"high","cvss":8.5,"epss":0.00135,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["astronomy","c","cfitsio","fits-processing","package","self-hosted"],"not_affected_if":["cfitsio-not-linked","no-untrusted-fits-input"],"how_to_check":"- Check the CFITSIO version linked into your application or library (look for `4.7.0` or earlier in your dependency manifests or build files; the sources do not give a command)\n- unknown for other checks: the sources do not say which programs call ffgcls2() or read untrusted FITS files","fix":"- Move CFITSIO past 4.7.0 once a fixed release is available; the sources do not name a fixed version\n- Until patched, do not open FITS files from untrusted sources with CFITSIO-based tools (unknown whether a workaround exists)","status":"open","published_at":"2026-10-22T20:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:00:18+00:00","updated_at":"2026-10-25T03:00:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move CFITSIO past 4.7.0 once a fixed release is available; the sources do not name a fixed version\n- Until patched, do not open FITS files from untrusted sources with CFITSIO-based tools (unknown whether a workaround exists)","reach":"unknown","title":"CFITSIO: crafted FITS file overflows buffer in ffgcls2, enabling code execution","impact":"high","summary":"CFITSIO through 4.7.0 has an out-of-bounds write in ffgcls2() in getcols.c, which trusts heap descriptor lengths for variable-length string columns. A crafted FITS file overflows a fixed stack buffer and the caller's string array, which the sources say enables arbitrary code execution.","category":"package","nicknames":[],"who_cares":["cfitsio","c","astronomy","fits-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker-supplied FITS file runs arbitrary code in the reading process","analyst_note":"Find the NVD record's CVSS vector and any fixed CFITSIO release or upstream commit to confirm the patched version and whether reading a file alone triggers the flaw.","how_to_check":"- Check the CFITSIO version linked into your application or library (look for `4.7.0` or earlier in your dependency manifests or build files; the sources do not give a command)\n- unknown for other checks: the sources do not say which programs call ffgcls2() or read untrusted FITS files","needs_analyst":true,"not_affected_if":["no-untrusted-fits-input","cfitsio-not-linked"],"who_is_affected":"Programs that link CFITSIO 4.7.0 or earlier and read FITS files that an outsider could supply, such as astronomy pipelines, image viewers or web services that process uploaded FITS data. The sources do not say whether ffgcls2() is reached by default in every build, so teams that only process their own trusted files are less exposed. Teams not using CFITSIO can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":3396,"output_tokens":726,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115504':14A,17A '-2026':13A,16A '28':116C '4.7.0':30B,78C '800':117C 'arbitrari':73B,128C 'array':67B,126C 'astronomi':18B 'attack':94C,105C 'attacker-control':93C 'bound':36B,84C 'buffer':6A,61B,120C 'byte':118C 'c':19B 'caller':64B,123C 'cfitsio':1A,20B,28B,76C 'code':10A,74B,129C 'column':52B,104C 'contain':79C 'control':95C 'craft':2A,54B,109C 'cve':12A,15A 'descriptor':45B,97C 'enabl':9A,72B,127C 'execut':11A,75B,130C 'ffgcls2':8A,39B,88C 'file':4A,56B,111C 'fit':3A,22B,55B,110C 'fits-process':21B 'fix':59B,115C 'getcols.c':41B,90C 'heap':44B,96C 'host':27B 'length':46B,50B,98C,102C 'out-of-bound':33B,81C 'overflow':5A,57B,113C 'packag':24B 'process':23B 'say':71B 'self':26B 'self-host':25B 'sourc':70B 'stack':60B,119C 'string':51B,66B,103C,125C 'suppli':107C 'trust':43B,92C 'variabl':49B,101C 'variable-length':48B,100C 'vulner':86C 'write':37B,85C","nicknames":[],"mitigations":[],"who_affected":"Programs that link CFITSIO 4.7.0 or earlier and read FITS files that an outsider could supply, such as astronomy pipelines, image viewers or web services that process uploaded FITS data. The sources do not say whether ffgcls2() is reached by default in every build, so teams that only process their own trusted files are less exposed. Teams not using CFITSIO can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115504","severity":null,"published_at":"2026-10-22T20:17:06+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115504","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115504","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}