HEASARC vulnerabilities
We track 3 vulnerabilities in HEASARC products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest HEASARC vulnerabilities
- 7.8 High severity
cfitsio: Out-of-bounds Write
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byt
- 7.1 High severity
cfitsio: Out-of-bounds Read
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMP
- 7.1 High severity
cfitsio: Out-of-bounds Read
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS