Key points
- CVE-2026-115504 affects CFITSIO versions up to and including 4.7.0.
- The vulnerability is rated High with a CVSS score of 8.5.
- Attackers can trigger arbitrary code execution by supplying a malicious FITS file.
CFITSIO versions through 4.7.0 contain a high-severity vulnerability identified as CVE-2026-115504. The flaw allows an attacker to execute arbitrary code on a system. The issue stems from how the library processes variable-length string columns. No patch has been confirmed yet, so users should assess their exposure immediately.
In plain English
The software component CFITSIO handles data files used in astronomy. A specific function named ffgcls2 in getcols.c fails to verify the length of data it receives. It trusts the size information provided by an attacker-controlled file. This trust leads to an out-of-bounds write error. An attacker can create a special FITS file that tricks the software into writing data beyond its intended boundaries. This can overwrite critical memory areas, leading to full system control.
The background
According to the National Vulnerability Database record, the weakness is classified as CWE-787. The flaw specifically involves trusting heap descriptor lengths for variable-length string columns. When the software processes a crafted file, it overflows a fixed 28,800-byte stack buffer. The overflow also impacts the caller's string array. This sequence of events enables arbitrary code execution. The affected versions include all releases up to 4.7.0, maintained by HEASARC.
What changes now
Users relying on CFITSIO must determine if they are running a vulnerable version. Since no fix exists, administrators cannot simply apply an update. They must evaluate whether their systems process untrusted FITS files. If external data is accepted, the risk is immediate. Organizations should monitor for any official advisory from HEASARC or the vendor. Until a patch is released, the only safe option may be to restrict file inputs.
Who needs to act first
Teams should prioritize systems that accept FITS files from external or untrusted sources. Check whether these systems are exposed to the internet or public networks. Isolate vulnerable servers to prevent lateral movement if exploitation occurs. Implement strict input validation where possible to reject malformed files. Back up critical data before making any configuration changes. Monitor logs for unusual activity that might indicate an attempted exploit. Reduce exposure by limiting who can upload or transfer these specific file types.
What to do and how to stay safe: CFITSIO
- Inventory all systems using CFITSIO and verify if the version is 4.7.0 or older.
- Restrict access to services that process FITS files to trusted internal users only.
- Deploy network-level filters to block unexpected FITS file transfers.
- Watch for vendor announcements regarding a security update for this CVE.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-115504?
The CVSS score is 8.5, which is rated as High severity.
Which versions of CFITSIO are affected?
All versions through 4.7.0 are affected by this vulnerability.
Is there a patch available for this flaw?
No, the source material does not confirm the existence of a patch.
