CVE-2026-5474: falha de média gravidade em NASA cFS
NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local network to execute the attack. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Produtos afetados
NASA · cFSCVEs relacionadas — NASA cFS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82480MEDIUMNASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflowEPSS 0.4%CVE-2026-82479MEDIUMNASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflowEPSS 0.4%CVE-2026-105164MEDIUMNASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-boundsEPSS 0.3%CVE-2026-5473LOWNASA cFS Pickle pickle.load deserializationEPSS 0.2%CVE-2026-5475MEDIUMNASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruptionEPSS 0.2%CVE-2026-5476LOWNASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflowEPSS 0.2%