CyberRota Analysis
AI-GeneratedThe vulnerability affects CFITSIO versions up to 4.7.0, specifically in the HCOMPRESS tile decoder, allowing attackers to perform heap-based out-of-bounds reads by supplying a specially crafted FITS file. This can lead to application crashes or the disclosure of limited heap memory, posing a risk to systems utilizing this library for processing FITS files. Organizations that rely on CFITSIO for scientific data processing should prioritize addressing this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
Related CVEs
Other vulnerabilities affecting the same vendor(s)