{"id":"UBUNTU-CVE-2026-111124","details":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.","modified":"2026-10-17T12:59:52.112778644Z","published":"2026-10-16T00:00:00Z","upstream":["CVE-2026-111124"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-111124"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-111124"},{"type":"REPORT","url":"https://github.com/HEASARC/cfitsio"},{"type":"REPORT","url":"https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L5353-L5362"},{"type":"REPORT","url":"https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L7495-L7516"},{"type":"REPORT","url":"https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-negative-zdither0-seed"}],"affected":[{"package":{"name":"cfitsio","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.370-5"],"ecosystem_specific":{"binaries":[{"binary_name":"libcfitsio-bin","binary_version":"3.370-5"},{"binary_name":"libcfitsio2","binary_version":"3.370-5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.410-1","3.420-3","3.430-1","3.430-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libcfitsio-bin","binary_version":"3.430-2"},{"binary_name":"libcfitsio5","binary_version":"3.430-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.470-3"],"ecosystem_specific":{"binaries":[{"binary_name":"libcfitsio-bin","binary_version":"3.470-3"},{"binary_name":"libcfitsio8","binary_version":"3.470-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.490-3","4.0.0-1"],"ecosystem_specific":{"binaries":[{"binary_version":"4.0.0-1","binary_name":"libcfitsio-bin"},{"binary_version":"4.0.0-1","binary_name":"libcfitsio9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-3","4.3.0-2","4.3.1-1","4.3.1-1.1build1","4.3.1-1.1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libcfitsio-bin","binary_version":"4.3.1-1.1build2"},{"binary_name":"libcfitsio10t64","binary_version":"4.3.1-1.1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.3-1","4.6.4-1","4.7.0-2"],"ecosystem_specific":{"binaries":[{"binary_version":"4.22+cfitsio4.7.0-2","binary_name":"fitsverify"},{"binary_name":"libcfitsio-bin","binary_version":"4.7.0-2"},{"binary_version":"4.7.0-2","binary_name":"libcfitsio10t64"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}},{"package":{"name":"cfitsio","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/cfitsio?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.2-2","4.6.3-1"],"ecosystem_specific":{"binaries":[{"binary_version":"4.22+cfitsio4.6.3-1","binary_name":"fitsverify"},{"binary_version":"4.6.3-1","binary_name":"libcfitsio-bin"},{"binary_name":"libcfitsio10t64","binary_version":"4.6.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-111124.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}