CVE-2026-5473: falha de baixa gravidade em NASA cFS
NASA cFS Pickle pickle.load deserialization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2epss 0.2%
A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
NASA · cFSCVEs relacionadas — NASA cFS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-5474MEDIUMNASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflowEPSS 0.4%CVE-2026-82480MEDIUMNASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflowEPSS 0.4%CVE-2026-82479MEDIUMNASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflowEPSS 0.4%CVE-2026-105164MEDIUMNASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-boundsEPSS 0.3%CVE-2026-5475MEDIUMNASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruptionEPSS 0.2%CVE-2026-5476LOWNASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflowEPSS 0.2%