CVE Alert: CVE-2026-115504 – HEASARC

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller’s string array, enabling arbitrary code execution.

**Risk verdict:** High impact but exposure is conditional on a user or service processing an attacker-supplied scientific data file; urgency cannot be calibrated fully because exploitation and likelihood flags are absent.

**Why this matters:** Successful exploitation could compromise the process handling the file, enabling data theft, tampering or service disruption. A public exploit-labelled reference is present, but there is no supplied PoC status, KEV listing, SSVC state or EPSS estimate to confirm current exploitation or prevalence.

**Most likely attack path:** An attacker supplies a crafted file through a workflow that opens or converts scientific data; the vulnerable library then processes it with low attack complexity and no attacker privileges. User interaction is required, but can be passive, such as opening an attachment or ingesting a submitted file; scope is unchanged, so impact is primarily limited to the affected process and its accessible data.

**Who is most exposed:** Research, astronomy and scientific-computing environments, plus applications or services that embed this FITS-format parsing library and accept files from outside trusted sources.

Alert on crashes or memory-corruption reports in FITS-processing jobs.

Review file-ingestion logs for unexpected sources and abnormal processing failures.

Check endpoint telemetry for unusual child processes or outbound activity after file handling.

Mitigation and prioritisation:

Upgrade to a maintainer-fixed release; verify the fix is included in packaged or statically linked copies.

Until patched, restrict file ingestion to trusted sources and process files in isolated, least-privileged environments.

Identify embedded dependencies across research pipelines and rebuild affected applications.

Test representative workflows, then deploy promptly; no KEV or EPSS threshold is provided to justify a priority-1 designation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.