Advisories » MGASA-2026-0567

Updated cfitsio package fixes security vulnerabilities

Publication date: 30 Oct 2026
Modification date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-111124 , CVE-2026-111125

Description

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read
vulnerability in the imcompress.c unquantize helpers that allows
attackers to read memory before the fits_rand_value table via a zero or
negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a
SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and
fits_read_pix(), to cause crashes or leak heap contents in decoded
pixels.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36537
• https://github.com/HEASARC/cfitsio
• https://www.cve.org/CVERecord?id=CVE-2026-111124
• https://www.cve.org/CVERecord?id=CVE-2026-111125

SRPMS

10/core

• cfitsio-4.7.0-1.mga10