Read the docs
TI-2018-02817 Aliases CVE-2018-3847GHSA-962f-cm8q-5q3r

Out-of-bounds write in nasa CFITSIO

Priority MEDIUM 43CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.

Why it matters now

EPSS 0.02842 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nasaCFITSIO3.42—No fix listedCNA
  • CFITSIO Vendornasa Affected 3.42 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nasa:cfitsio:3.42:*:*:*:*:*:*:*3.42Vulnerablenasa
  • cpe:2.3:a:nasa:cfitsio:3.42:*:*:*:*:*:*:* Versions 3.42 Vulnerable ·nasa

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-3847
  2. 2026-10-03 Alias added: GHSA-962f-cm8q-5q3r

References

Exploit 1

Advisory 1

  • TI-2026-74909 Heap out-of-bounds read in CFITSIO HCOMPRESS tile decoder CVSS 4.0MEDIUM 6.9
  • TI-2026-74908 Heap out-of-bounds read in CFITSIO via negative ZDITHER0 seed CVSS 4.0MEDIUM 6.9
  • TI-2019-15966 Memory corruption in nasa CFITSIO CVSS 3.0CRITICAL 9.8
  • TI-2018-02819 Out-of-bounds write in Talos NASA CFITSIO CVSS 3.1HIGH 8.8
  • TI-2018-02818 Out-of-bounds write in Talos NASA CFITSIO CVSS 3.1HIGH 8.8
  • TI-2018-02816 Out-of-bounds write in Talos NASA CFITSIO CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences