CVE-2026-111125: Out-of-bounds Read in HEASARC cfitsio

CVE-2026-111125 is a heap-based out-of-bounds read vulnerability in the HEASARC cfitsio library through version 4.7.0. The issue exists in the HCOMPRESS tile decoder, specifically in the fits_hdecompress.c file's input_nnybble function. An attacker can supply a malicious FITS file with a ZCMPTYPE of HCOMPRESS_1 that declares oversized tile geometry, triggering reads beyond the allocated compressed tile buffer. This can lead to application crashes or limited disclosure of heap memory when functions like fits_read_pix process the crafted file.

Successful exploitation can cause denial of service via application crashes or limited disclosure of heap memory contents. There is no indication of privilege escalation or remote code execution. The impact is limited to local or user-level attacks involving crafted FITS files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted FITS files with HCOMPRESS_1 compression using vulnerable versions of cfitsio.