CVE-2025-25372

The NASA cFS (Core Flight System) Aquila software is vulnerable to a segmentation fault within the Memory Management Module . This issue is triggered by the transmission of a malicious telecommand , which can potentially result in memory corruption . The vulnerability is classified as an out-of-b...

CVE-2025-25374

The NASA cFS (Core Flight System) Aquila is vulnerable to an uncontrolled resource consumption issue (CWE-400) that can put the onboard software into a state preventing the launch of any external application. This results in a platform denial of service . While the specific affected versions are ...

CVE-2025-25371

The NASA cFS (Core Flight System) Aquila is susceptible to a path traversal vulnerability within the OSAL module . This flaw allows an attacker to override any arbitrary file on the system. While a proof-of-concept has been published, no specific remediation or patched version is currently provid...

CVE-2025-25373

The NASA cFS (Core Flight System) Aquila software is affected by a vulnerability in its Memory Management Module due to insecure permissions (CWE-732). This flaw can be exploited to achieve remote code execution (RCE) on the platform. While a proof-of-concept has been published, no specific patch...

CVE-2026-5474

CVE-2026-5474 affects NASA cFS up to 7.0.0. The vulnerability is in CFE_MSG_GetSize (file apps/to_lab/fsw/src/to_lab_passthru_encode.c, CCSDS Packet Header Handler) and results in a heap-based buffer overflow when manipulated. Exploitation requires local network access. Multiple sources (NVD, Red...

CVE-2026-5473

CVE-2026-5473 affects NASA cFS (up to 7.0.0). The vulnerable element is the Pickle Module’s pickle.load, enabling deserialization. The attack is local, requires a high level of complexity, and exploitation is deemed difficult. Public disclosure exists, and the project was informed via an issue bu...

CVE-2026-5476

CVE-2026-5476 affects NASA cFS up to 7.0.0 on 32-bit. The vulnerability is in CFE_TBL_ValidateCodecLoadSize (cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c) and is caused by an integer overflow. The documented attack complexity is high and exploitability is described as difficult. A fix is plan...

CVE-2026-5475

NASA cFS up to 7.0.0 contains a memory corruption vulnerability in the CCSDS Header Size Handler. The affected function is CFE_SB_TransmitMsg in cfe_sb_priv.c, within the CCSDS Header Size Handler component. The issue is triggered by a manipulation of input leading to memory corruption. The CVE e...