Vulnerability Spotlight: TALOS-2018-0529-531 - Multiple Vulnerabilities in NASA CFITSIO library
Summary: Talos disclosed three remote code execution vulnerabilities in NASA's CFITSIO library version 3.42, a C and Fortran library for reading and writing FITS astronomical data files. Crafted keyword-value pairs in a FITS image header trigger stack-based buffer overflows in the library's error handling, tracked as TALOS-2018-0529 through TALOS-2018-0531 and CVE-2018-3846 through CVE-2018-3849.
Key Takeaway: The flaw sits in error handling, so a malformed image header is enough to overflow a buffer that was never sized for it, and an attacker who delivers that image can potentially execute code. Snort rules 45697-45700 and 45701-45714 cover known exploitation attempts, but Talos notes additional rules may follow and current ones are subject to change.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-3846CVE-2018-3847CVE-2018-3848CVE-2018-3849
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026