CyberRota Analysis
AI-GeneratedCFITSIO versions up to 4.7.0 are vulnerable to a heap-based out-of-bounds read due to improper handling of the ZDITHER0 seed in the imcompress.c unquantize helpers. This vulnerability allows attackers to exploit crafted FITS files to either crash the application or leak sensitive memory contents. Organizations utilizing CFITSIO for handling FITS files should prioritize patching this vulnerability to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
Related CVEs
Other vulnerabilities affecting the same vendor(s)