Is CVE-2026-115504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115504 being exploited in the wild.

How severe is CVE-2026-115504?

High severity, with a CVSS score of 7.8, published 22 October 2026.

Is there a fix for CVE-2026-115504?

Yes: fixed in CFITSIO versions including commit de7da7908bca0b9ed70d219a35e8627667ced779 or later (merged in PR #184, 2026-09-14). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115504 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115504?

Check whether you run HEASARC CFITSIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115504: CFITSIO heap out-of-bounds write in ffgcls2

CVE-2026-115504 · Severity: high · CVSS 7.8 · Published 2026-10-22

CFITSIO is a library for reading and writing FITS astronomical data files. A crafted FITS file can trigger a heap buffer overflow in the variable-length string column handler, allowing an attacker to corrupt memory and execute arbitrary code when the file is processed by applications using CFITSIO, such as fitsverify.

Technologies: HEASARC CFITSIO. Vendors: HEASARC.

Quick answers

Is CVE-2026-115504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115504 being exploited in the wild.
How severe is CVE-2026-115504?: High severity, with a CVSS score of 7.8, published 22 October 2026.
Which products and versions are affected?: HEASARC CFITSIO through 4.7.0.
Is there a fix for CVE-2026-115504?: Yes: fixed in CFITSIO versions including commit de7da7908bca0b9ed70d219a35e8627667ced779 or later (merged in PR #184, 2026-09-14). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115504 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115504?: Check whether you run HEASARC CFITSIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CFITSIO versions including commit de7da7908bca0b9ed70d219a35e8627667ced779 or later (merged in PR #184, 2026-09-14)

Technical details

An out-of-bounds write vulnerability exists in ffgcls2() (getcols.c) where attacker-controlled column width values from FITS file headers are used to write into a fixed-size heap buffer without bounds validation. This allows heap memory corruption leading to arbitrary code execution. The fix adds bounds checking before the write operation.

Affected products

HEASARC CFITSIO through 4.7.0

Timeline

2026-10-22: disclosed
2026-09-14: patched: Public fix merged to develop branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.