Skip to content
98f15c7e8f48dc90ae65646f926aa176

98f15c7e8f48dc90ae65646f926aa176

gist.github.com • October 23, 2026

Status: Fixed upstream. Public advisory. CVE ID: CVE-2026-115504 (assigned by VulnCheck CNA) Discoverer / credit: Pratyaksh Srivats (alias: Oswin Haward)

A heap out-of-bounds write exists in CFITSIO's ffgcls2() function ( getcols.c ) when reading a variable-length string column from a crafted FITS file. A column width ( twidth ) taken from attacker-controlled header values is used to write into a fixed-size heap buffer without first checking that the width fits the buffer. A malformed FITS file processed by fitsverify or any application linking CFITSIO can therefore corrupt heap memory.

CWE: CWE-787 (Out-of-bounds Write)

Component: getcols.c , function ffgcls2()

Impact: Attacker-controlled heap memory corruption from untrusted file input

CVSS 4.0: 7.1 (HIGH) — AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CFITSIO 4.6.4 — confirmed.

develop branch (pre-4.7.0) — confirmed present prior to the fix below.

CVE record scope: CFITSIO through 4.7.0 (the fix is not yet in a tagged release).

Fixed upstream by HEASARC (ticket #10052). The fix adds a bounds check on the required write size against the destination buffer in ffgcls2() before the write, and also touches utilities/fvrf_data.c (fitsverify).

Fix commit ( develop ): de7da7908bca0b9ed70d219a35e8627667ced779

Public PR: HEASARC/cfitsio #184 — "fix: check variable-length string buffer bounds before read" — merged 2026-09-14.

No tagged release includes the fix yet. Until one ships, build from develop at or after the commit above.

2026-08-01 — Reported to HEASARC / CFITSIO maintainers.

2026-08-04 — Acknowledged by vendor.

2026-08-13 — CVE requested from MITRE CNA-LR (CAN-2026-2035685), under embargo.

2026-09-10 — Fix confirmed checked into develop (ticket #10052); publication requested to MITRE.

2026-09-14 — Public fix merged (PR #184).

2026-10-22 — CVE requested from VulnCheck CNA; CVE-2026-115504 published.

Two further bugs were found in the same component but are out of scope for this advisory and may be tracked separately: a heap out-of-bounds read ( buffers.c ) and a stack-use-after-return ( getcols.c ).

Extracted Entities