CVE-2018-3846

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-16 · updated 2026-06-17
Weakness: CWE-787

Description

In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.

Affected products

Fedoraproject Fedora: 28
HEASARC cfitsio: 3.42

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
https://security.gentoo.org/glsa/202101-24
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
https://security.gentoo.org/glsa/202101-24
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529

Get alerted when CVE-2018-3846 or the next vulnerability affects your stack