CFITSIO: Out-of-bounds write in ffgcls2() via crafted FITS file
Summary
CFITSIO through 4.7.0 contains an out-of-bounds write in ffgcls2() in getcols.c. A crafted FITS file with attacker-controlled header values can overwrite memory when a variable-length string column is read. The CVE record states this can enable arbitrary code execution. The attack requires a user or application to process the malicious file, and no network-listening component is described.
Affected
- CFITSIO 0 to 4.7.0 (according to the CVE record)
- Distributions and applications that bundle CFITSIO, including some GDAL builds (status varies)
Fixed in
Unknown. Upstream PR #184 was merged on 2026-09-14, but no tagged release has been confirmed to contain the fix. Build from the develop branch after the fix commit, or wait for a distribution update.
Workaround
- No vendor-confirmed workaround found.
- Do not open or process FITS files from untrusted sources.
- Restrict any service that accepts FITS uploads.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed as known exploited.
- A public reference to exploit code may exist, but this is unverified.
- EPSS is low (0.00133).
Our recommendation
- Inventory installed libcfitsio and CFITSIO-linked software, including GDAL.
- Restrict or avoid processing FITS files from untrusted sources.
- Restrict upload services that parse FITS files.
- Install vendor updates as soon as a release with the fix is available, and confirm the fixed version first.
- Monitor the HEASARC repository and your distribution's security tracker.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck advisory) www.vulncheck.com
- HEASARC CFITSIO repository github.com
- Upstream pull request #184 github.com
- Upstream commit 579792e github.com
- Ubuntu security notice ubuntu.com
- VulDB entry vuldb.com
- Vulners OSV entry vulners.com
- HEASARC CFITSIO documentation heasarc.gsfc.nasa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:15.
Original description (NVD)
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
NVD references (5)
- https://gist.github.com/yure1432/98f15c7e8f48dc90ae65646f926aa176
- https://github.com/HEASARC/cfitsio
- https://github.com/HEASARC/cfitsio/commit/579792e0f85bff0c6733ad5ebdf54c3b5c188686
- https://github.com/HEASARC/cfitsio/pull/184
- https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-out-of-bounds-write-via-ffgcls2-in-getcols-c
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.