CVE-2026-111125 in CFITSIO
Summary
by MITRE • 10/15/2026
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within CFITSIO versions up to 4.7.0 represents a critical security flaw located in the implementation of the HCOMPRESS tile decoder, specifically affecting the decompression logic for astronomical image data stored in Flexible Image Transport System formats. This issue is classified as CWE-125, which denotes an out-of-bounds read vulnerability where software reads data past the end or before the beginning of a buffer. The root cause lies in insufficient validation of input parameters during the decompression process, particularly concerning the handling of tile geometry and nnybble values defined within the FITS header metadata. When an application processes a maliciously crafted FITS file that declares oversized tile dimensions via the ZCMPTYPE HCOMPRESS_1 extension attribute, the decoder fails to properly bound-check memory access operations against the actual allocated size of the compressed tile buffer.
From a technical perspective, the flaw manifests in the fits_hdecompress.c module where the function responsible for decompressing tiles does not adequately verify that the requested number of nybbles or pixel dimensions align with the physical limits of the pre-allocated heap memory region. By supplying an input_nnybble value that exceeds safe boundaries while maintaining a valid file structure, an attacker can trigger a read operation that accesses memory locations outside the intended buffer scope. This behavior allows for the leakage of limited amounts of heap memory contents adjacent to the tile data structure. The vulnerability is exploitable through standard API calls such as fits_read_pix, which are commonly used by scientific applications and image processing software to retrieve pixel data from FITS files.
The operational impact of this vulnerability extends beyond simple application crashes, although denial of service remains a significant risk if the out-of-bounds read triggers an access violation or segmentation fault in strict memory management environments. More critically, the ability to disclose heap memory contents can lead to information disclosure attacks where sensitive data residing in adjacent memory regions is leaked to the attacker. In complex applications that process multiple images concurrently, this could potentially expose cryptographic keys, user credentials, or other proprietary data structures stored on the heap. This aligns with ATT&CK technique T1083, which covers File and Directory Discovery, as well as broader categories of Memory Scraping where attackers extract valuable information from volatile memory to facilitate further exploitation stages such as privilege escalation or lateral movement within a compromised system.
Mitigation strategies for this vulnerability primarily involve upgrading the CFITSIO library to version 4.7.1 or later, where developers have implemented stricter bounds checking and validation logic in the HCOMPRESS decoder. For organizations unable to immediately update their dependencies, defensive coding practices should be enforced by validating all FITS header parameters before passing them to decompression routines. Additionally, deploying runtime application self-protection mechanisms that monitor for abnormal memory access patterns can help detect exploitation attempts. Security teams should also audit any custom wrappers around fits_read_pix or similar functions to ensure they perform independent validation of tile geometry and compression type attributes against expected maximums defined by the FITS standard specification.