PT-2026-115131 · Heasarc · Cfitsio
CVSS v3.1
6.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input nnybble in fits hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS 1 declaring oversized tile geometry to crash applications calling fits read pix or disclose limited heap memory.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cfitsio