CVE-2026-115504 in CFITSIO
Summary
by MITRE • 10/22/2026
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in CFITSIO versions through 4.7.0 represents a critical security flaw rooted in improper input validation within the library’s handling of Flexible Image Transport System files. Specifically, the defect resides in the ffgcls2 function located in the getcols.c source file. This component is responsible for retrieving column data from FITS tables, which are widely used in scientific and astronomical applications to store large datasets with complex structures. The core issue arises when the library processes variable-length string columns, where it relies on heap descriptor lengths provided within the crafted input file without sufficient verification against expected bounds or buffer capacities.
From a technical perspective, this flaw constitutes an out-of-bounds write vulnerability that allows for stack-based buffer overflow and potential heap corruption. When an attacker supplies a maliciously constructed FITS file containing manipulated metadata regarding string column sizes, the ffgcls2 function allocates memory based on these untrusted values. If the specified length exceeds the allocated space of the fixed 28,800-byte stack buffer or the caller's associated string array, the write operation proceeds beyond the intended boundaries. This overflow overwrites adjacent memory locations, which can include return addresses, frame pointers, and other critical control data structures stored on the call stack.
The operational impact of this vulnerability is severe, as it enables arbitrary code execution under certain conditions. By carefully crafting the payload to overwrite specific memory regions with shellcode or ROP gadgets, an attacker can hijack the program's control flow. This capability allows for full system compromise if the vulnerable application runs with elevated privileges. Given that CFITSIO is often integrated into high-performance computing environments and scientific pipelines where data integrity and availability are paramount, such a breach could lead to unauthorized access to sensitive research data or serve as an entry point for lateral movement within networked infrastructure.
This vulnerability aligns with CWE-120, which describes buffer copy without checking size limits, leading to out-of-bounds writes. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to memory corruption and code injection, specifically those involving stack-based overflows used for privilege escalation or remote execution. The lack of rigorous bounds checking on external inputs highlights a common pattern in legacy C libraries where performance optimizations sometimes bypass safety checks that are critical for security resilience.
Mitigation strategies must prioritize immediate patching to the latest stable version of CFITSIO, which includes fixes for this specific memory management issue. In environments where upgrading is not immediately feasible, administrators should implement strict input validation at the application layer before passing FITS files to the library. This involves verifying that all column descriptors and string lengths conform to expected maximums defined by the FITS standard or organizational policies. Additionally, deploying runtime protection mechanisms such as stack canaries, Address Space Layout Randomization, and Data Execution Prevention can significantly reduce the likelihood of successful exploitation by mitigating the impact of memory corruption attempts. Regular security audits focusing on C/C++ codebases are recommended to identify similar patterns of unsafe memory handling across other components within the software ecosystem.