High severity8.8NVD Advisory· Published Apr 16, 2018· Updated Jun 17, 2026

CVE-2018-3849

Description

In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nasa/CFITSIO2 versions
cpe:2.3:a:nasa:cfitsio:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nasa:cfitsio:*:*:*:*:*:*:*:*range: <3.490
- (no CPE)range: = 3.42
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
Talos/NASA CFITSIOv5
Range: NASA CFITSIO 3.42

Patches

Vulnerability mechanics

References

www.talosintelligence.com/vulnerability_reports/TALOS-2018-0531nvdExploitTechnical DescriptionThird Party Advisory
security.gentoo.org/glsa/202101-24nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000