Every CVE Search/ Get API key

CVE-2026-115504

CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c

8.5 High

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.17%Unchanged since Oct 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.5

CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
CVE-2026-115504
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-108336 8.5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
EUVD-2026-108336
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wjcj-f49x-x56c 8.5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c...

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
GHSA-wjcj-f49x-x56c
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 8.5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
CVE-2026-115504
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 8.5

CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
CVE-2026-115504
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-115504 8.5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
DEBIAN-CVE-2026-115504
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-115504 8.5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
UBUNTU-CVE-2026-115504
CVSS 4.0
8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-110540 No score

CVE-2026-115504 affecting package cfitsio 4.0.0-5

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.

Record
AZL-110540
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cfitsio
Azure Linux:3
 through 4.0.0-5 None known
cfitsio
Debian:12
 All versions, plus listed versions
4.2.0-34.3.0-14.3.0-24.3.1-14.3.1-1.1
Show 14 moreShow less
4.3.1-1.1~exp14.4.1-14.4.1-24.5.0-14.5.0-24.5.0-34.5.0-44.5.0-54.6.2-14.6.2-24.6.3-14.6.4-14.7.0-14.7.0-2
 None known
cfitsio
Debian:13
 All versions, plus listed versions
4.6.2-24.6.3-14.6.4-14.7.0-14.7.0-2
 None known
cfitsio
Debian:14
 All versions, plus listed versions
4.6.2-24.6.3-14.6.4-14.7.0-14.7.0-2
 None known
cfitsio
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.370-5
 None known
cfitsio
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.410-13.420-33.430-13.430-2
 None known
cfitsio
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.470-3
 None known
cfitsio
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.490-34.0.0-1
 None known
cfitsio
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.2.0-34.3.0-24.3.1-14.3.1-1.1build14.3.1-1.1build2
 None known
cfitsio
Ubuntu:26.10
 All versions, plus listed versions
4.6.3-14.6.4-14.7.0-2
 None known
cfitsio
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.6.2-24.6.3-1
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-115504 is a high vulnerability (CVSS 8.5) in Heasarc Cfitsio, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open