CVE-2026-111124: Out-of-bounds Read in HEASARC cfitsio

CVE-2026-111124 is a heap-based out-of-bounds read vulnerability in the HEASARC cfitsio library (up to version 4.7.0). The vulnerability exists in the imcompress.c unquantize helpers, where a zero or negative ZDITHER0 seed allows reading memory before the fits_rand_value table. An attacker can craft a FITS file containing a SUBTRACTIVE_DITHER_1 compressed image that, when opened and read using fits_open_file() and fits_read_pix(), triggers the out-of-bounds read. This can lead to application crashes or disclosure of heap memory contents within decoded pixel data.

Successful exploitation can cause application crashes or leak sensitive heap memory contents during pixel decoding. The vulnerability requires local access to supply a crafted FITS file and user interaction to open and read the file. The CVSS 4.0 base score is 6.9 (medium severity), reflecting limited attack vector (local), low complexity, no privileges required, and user interaction needed. There is no indication of remote exploitation or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening untrusted FITS files containing SUBTRACTIVE_DITHER_1 compressed images with cfitsio versions up to 4.7.0. Monitor vendor channels for updates and patches addressing this vulnerability.