CVE-2026-82479

NASA cFS (core Flight System) up to version 7.0.1 contains a buffer overflow in the SBN TCP Module . The vulnerable function is OS_read in the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c , where manipulation of the MsgSz argument leads to the overflow. The attack must be conducted from within ...

CVE-2026-82480: Integer Underflow (Wrap or Wraparound)

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFESBGetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfesbutil.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer...

CVE-2026-82479: Buffer Copy without Checking Size of Input

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OSread of the file modules/protocol/tcp/fsw/src/sbntcpif.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local...

PT-2026-83522

Name of the Vulnerable Software and Affected Versions NASA cFS versions prior to 7.0.2 Description A security flaw exists in the cFE Software Bus component within the CFE SB GetUserDataLength function located in the src/cFS/cfe/modules/sb/fsw/src/cfe sb util.c file. A remote attacker can trigger ...

PT-2026-83521

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS read of the file modules/protocol/tcp/fsw/src/sbn tcp if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local...

PT-2026-67856

Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description Incorrect access control in the Executive Services dynamic application start path component allows attackers to execute arbitrary code by placing a shared object on target storage. Recommendations At the...

CVE-2026-67979: Improper Access Control

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

CVE-2026-67970: Improper Access Control

Incorrect access control in the DSSetDestPathCmd component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal...

CVE-2026-67972: Exposure of Sensitive Information to an Unauthorized Actor

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

CVE-2026-67974: Improper Input Validation

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-67973: Uncontrolled Resource Consumption

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

CVE-2026-67969: Improper Input Validation

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

CVE-2026-67975: Improper Access Control

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

CVE-2026-67978: Improper Input Validation

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via transmitting a crafted SBN frame...

CVE-2026-18064: NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-5473

A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is...

CVE-2026-5476

A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFETBLValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfetblpassthrucodec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to b...

CVE-2026-5474 NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow

A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFEMSGGetSize of the file apps/tolab/fsw/src/tolabpassthruencode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local...

CVE-2026-5473

A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is...

CVE-2026-5476: Integer Overflow or Wraparound

A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFETBLValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfetblpassthrucodec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to b...