gist.github.com CVE-2026-115504: High-Risk Vulnerability in CFITSIO Library
Article Content
- •CVE-2026-115504 allows arbitrary code execution via crafted FITS files.
- •The vulnerability affects CFITSIO versions up to 4.7.0, primarily in scientific environments.
- •A fix is available upstream but not yet in a tagged release; users should restrict file ingestion.
CVE-2026-115504 is a high-risk out-of-bounds write vulnerability in the CFITSIO library, specifically in the ffgcls2() function within getcols.c. This flaw allows attackers to supply a crafted FITS file that can overflow a fixed 28,800-byte stack buffer, leading to potential arbitrary code execution. Affected systems include those using CFITSIO versions up to 4.7.0, particularly in research, astronomy, and scientific computing environments. The vulnerability requires user interaction, such as opening a malicious file, but can be exploited with low complexity. A fix has been developed and is available in the upstream repository, but it has not yet been included in a tagged release. Users are advised to restrict file ingestion to trusted sources until the patch is applied. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-115504 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of CFITSIO are affected?
Is there a patch available?
What should organizations do to mitigate this risk?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…