CVE-2026-111124 in CFITSIO
Summary
by MITRE • 10/15/2026
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within CFITSIO versions up to 4.7.0 represents a critical memory safety flaw located specifically within the unquantize helper functions found in the imcompress.c source file. This library is widely utilized for reading and writing Flexible Image Transport System files, which are standard formats in astronomy and other scientific fields that require precise data handling. The core of the issue lies in how the software processes compressed images utilizing SUBTRACTIVE_DITHER_1 compression schemes when a specific parameter known as ZDITHER0 is involved. Under normal operational conditions, this seed value guides the dequantization process to accurately reconstruct pixel values from their compressed state. However, the implementation fails to adequately validate input parameters before proceeding with memory access operations related to the fits_rand_value table, which serves as a lookup or reference structure during this decoding phase.
The technical mechanism of exploitation hinges on an attacker supplying a maliciously crafted FITS file that contains a SUBTRACTIVE_DITHER_1 compressed image segment. When such a file is processed through standard API calls like fits_open_file followed by fits_read_pix, the library attempts to decompress and decode the pixel data. If the ZDITHER0 seed value embedded in the header or metadata of this crafted file is set to zero or a negative integer, it triggers an arithmetic error during index calculation within the unquantization routine. This miscalculation results in an attempt to access memory addresses that reside before the beginning of the fits_rand_value table buffer. Because C does not perform automatic bounds checking on array accesses, this leads directly to a heap-based out-of-bounds read condition. The attacker can thus force the application to retrieve arbitrary data from adjacent regions of the heap memory space rather than the intended structured data.
The operational impact of this vulnerability is significant due to its potential for both denial of service and information disclosure. In scenarios where the application handles untrusted input without additional sandboxing, triggering this out-of-bounds read can cause immediate crashes or segmentation faults, effectively denying service to legitimate users attempting to process scientific imagery. More critically, the ability to leak heap contents allows an attacker to exfiltrate sensitive data that may reside in memory adjacent to the target buffer. This could include cryptographic keys, user credentials, session tokens, or other proprietary information processed by the application prior to reading the malicious file. Such memory leaks can facilitate further attacks, including side-channel analysis or direct exploitation of subsequent vulnerabilities if the leaked data reveals internal state structures.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read, as it involves accessing memory beyond the intended boundary of an allocated buffer. It also relates to CWE-787, indicating that the root cause is likely improper validation or lack of bounds checking on array indices derived from external input. In terms of adversary tactics, this flaw supports techniques associated with ATT&CK technique T1059, Command and Scripting Interpreter, if leveraged in conjunction with other exploits to execute code, though primarily it serves reconnaissance purposes under T1083, File and Directory Discovery, by allowing the attacker to probe memory contents. The vulnerability underscores the importance of rigorous input validation for numerical parameters that directly influence array indexing logic within low-level image processing libraries.
Mitigation strategies should prioritize immediate patching to version 4.7.1 or later where this issue has been addressed through enhanced bounds checking and parameter validation in the imcompress.c module. For environments where upgrading is not immediately feasible, administrators can implement strict input filtering at the application layer to reject FITS files containing ZDITHER0 values that are zero or negative before they reach the CFITSIO library functions. Additionally, deploying memory protection mechanisms such as Address Space Layout Randomization and heap sanitizers during development and testing phases can help detect similar issues early in the software lifecycle. Regular security audits focusing on C/C++ codebases should emphasize verifying all array indices against buffer sizes to prevent out-of-bounds access patterns that compromise application integrity and confidentiality.