HEASARC CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH HEASARC CVE published 2026-10-22

CVE-2026-115504

A CVE Program record and NVD vulnerability detail page describe an out-of-bounds write vulnerability in CFITSIO through 4.7.0, which can be exploited via a crafted FITS file to enable arbitrary code execution. The vulnerability is caused by the ffgcls2() function in getcols.c, which does not properly validate heap descriptor lengths for variable-length string columns. This oversight allows attackers to ov [truncated]