Heap-based Out-of-Bounds Read in CFITSIO

Executive Summary

CVE-2026-111124 is a heap-based out-of-bounds read vulnerability in CFITSIO through version 4.7.0. It occurs in the imcompress.c file's unquantize helper functions. Attackers can exploit this by providing a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image and using a zero or negative ZDITHER0 seed. This causes the software to read memory before the fits_rand_value table, potentially leading to crashes or leaking heap contents during pixel decoding.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or memory leaks when processing FITS files with CFITSIO 4.7.0 or earlier. Use tools like AddressSanitizer to identify heap out-of-bounds reads during file operations. Check for negative ZDITHER0 seeds in FITS headers and SUBTRACTIVE_DITHER_1 compressed images.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause application crashes or memory leaks when processing malicious FITS files. Attackers could exploit it to read sensitive memory contents, leading to information disclosure. Systems using CFITSIO for image processing may experience instability or crashes if exposed to specially crafted files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a memory leak and out-of-bounds read in the CFITSIO library, which is unrelated to data protection or privacy requirements. However, if exploited, it could lead to system instability or crashes, potentially disrupting operations in environments handling sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CFITSIO to a patched version beyond 4.7.0. If upgrading is not possible, avoid processing untrusted FITS files with SUBTRACTIVE_DITHER_1 compression or negative ZDITHER0 seeds. Implement input validation to reject malformed headers.

Useful 0 Not Useful 0