NASA cFS CVE-2026-105164

Exploitation requires an attacker with high privileges (CVSS PR:H) able to reach cFS file-system parsing and supply a crafted input file name that is processed by CFE_FS_ParseInputFileNameEx; the trigger is the file-name parsing path in cfe/modules/fs/fsw/src/cfe_fs_api.c. Limiting factors: the attacker must already hold privileged/authenticated access to the flight-software environment (so this is not unauthenticated), impact is confined to an out-of-bounds read causing a low availability effect (VA:L) with no confidentiality or integrity loss, affected versions are cFS up to and including 7.0.1, and the fix remains an unaccepted pull request so no vendor-blessed patched version is yet available.

This is a genuinely low-to-moderate-risk issue despite the 'network' attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) reports a base score of 5.1 (MEDIUM), and the only impact is VA:L - a low availability impact - with no confidentiality (VC:N) or integrity (VI:N) consequence, consistent with an out-of-bounds READ (not a write/overflow) in CFE_FS_ParseInputFileNameEx. The decisive mitigating signal is PR:H: exploitation requires high (operator/administrative) privileges on the flight software, which dramatically narrows the realistic threat population. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no public exploit code was provided - the upstream fix is still an unaccepted pull request (nasa/cFS#984, issue #893), so the vulnerability is public-but-unpatched. Note a signal tension worth flagging: the description states 'Remote exploitation is possible' (matching AV:N), yet PR:H means the 'remote' attacker must already hold privileged access to submit/parse a crafted file name - so this is far from unauthenticated remote code execution and behaves more like a privileged-operator-triggered denial condition. Verdict: a real but low-priority memory-safety bug, not an urgent widely-exploitable flaw.

An actor already holding privileged access to a cFS deployment supplies a crafted input file name that CFE_FS_ParseInputFileNameEx parses, causing an out-of-bounds read that can crash or destabilize the affected flight-software component (availability impact). No public proof-of-concept exists; the only artifact is the pending upstream fix PR, so weaponization would require independent development. Because CVSS specifies PR:H, the attacker must first obtain high privileges, making this a privileged-trigger denial-of-service rather than a drive-by remote compromise.