CVE-2026-115504 HEASARC CVE debrief

Who should care

Defenders responsible for CFITSIO installations, particularly in environments where FITS files are processed, should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability.

Why it matters

Defenders should prioritize verifying and updating CFITSIO installations to prevent exploitation, as the vulnerability can be used for arbitrary code execution.

• Potential arbitrary code execution
• Possible disruption of scientific computing and data analysis workflows
• Need for verification of CFITSIO installations and FITS file input validation
• Potential data corruption or manipulation

Technical summary

The vulnerability is caused by an out-of-bounds write in the ffgcls2() function in getcols.c, which trusts attacker-controlled heap descriptor lengths for variable-length string columns. This oversight allows attackers to overflow a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution. The vulnerability has been publicly disclosed and defenders should prioritize verifying and updating CFITSIO installations to prevent exploitation. The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating CFITSIO installations to prevent exploitation.

Recommended defensive actions

• Verify CFITSIO installations and update to a fixed version
• Review and restrict FITS file inputs to prevent exploitation
• Monitor for suspicious activity related to CFITSIO
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. Additional technical details are available in a GitHub gist and a VulnCheck advisory. The vulnerability has been confirmed to affect CFITSIO through 4.7.0 and may affect other versions. Defenders should verify CFITSIO installations and review FITS file input validation to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.