Security readout for executives and security teams
Plain-English summary
CVE-2018-3846 affects NASA CFITSIO 3.42, a library used to read FIT/FITS scientific image files. A malicious image could crash or compromise software that parses it. The issue is high severity because successful exploitation may allow code execution, but the victim must process a crafted file.
Executive priority
Prioritize remediation where CFITSIO processes externally supplied image files. The risk is not shown as actively exploited in the provided sources, but potential code execution justifies prompt patching and exposure review.
Technical view
Talos reported stack-based buffer overflows in CFITSIO 3.42 functions ffgphd and ffgtkn. Specially crafted images parsed by the library can overwrite arbitrary stack data and may lead to code execution. CVSS 3.0 is 8.8 with network attack vector and user interaction required.
Likely exposure
Exposure is most likely in astronomy, research, imaging, or data-processing systems that accept FIT/FITS files and use CFITSIO 3.42 directly or through packaged applications. Systems not processing untrusted FIT images, or not using this version, have lower likely exposure.
Exploitation context
The bundle does not cite CISA KEV listing or active exploitation. The known attack path is delivery of a crafted FIT image that a vulnerable application parses. Treat internet-facing upload pipelines and shared research file workflows as higher concern.
Researcher notes
The source bundle identifies CFITSIO 3.42 and functions ffgphd and ffgtkn. It does not provide complete affected-version ranges, fixed upstream versions, or exploitation telemetry. Validate through local dependency inspection and vendor advisories rather than assuming broader product impact.
Mitigation direction
- Inventory software and services that link or package CFITSIO.
- Upgrade CFITSIO through vendor or distribution advisories where available.
- Prioritize systems accepting FIT/FITS files from external users or partners.
- Restrict untrusted FIT/FITS ingestion until patched or isolated.
- Check Fedora, Gentoo, Talos, and upstream guidance for fixed package details.
Validation and detection
- Confirm installed CFITSIO versions on affected hosts and containers.
- Trace applications that parse FIT/FITS files through CFITSIO.
- Review file-upload, batch-processing, and research data import workflows.
- Verify vendor package updates were applied successfully.
- Run regression tests for FIT/FITS parsing after remediation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-3846 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- FEDORA-2019-3c1aed2aa9CVE reference · vendor-advisory, x_refsource_FEDORA
- GLSA-202101-24CVE reference · vendor-advisory, x_refsource_GENTOO
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.