CVE-2018-3848

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-16 · updated 2026-06-17
Weakness: CWE-787

Description

In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.

Affected products

Fedoraproject Fedora: 28
HEASARC cfitsio: before 3.490 — fixed in 3.490

How to fix

Upgrade to a fixed version: HEASARC cfitsio 3.490. Check the vendor advisory for mitigations.

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
https://security.gentoo.org/glsa/202101-24
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0531
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
https://security.gentoo.org/glsa/202101-24
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0531

Get alerted when CVE-2018-3848 or the next vulnerability affects your stack