NASA cFS CVE-2026-15352

Exploitation requires the attacker to deliver a Housekeeping Telemetry request message to the cFS Health & Safety (HS) application over the cFS Software Bus / telemetry interface (AV:N, PR:N, UI:N). The limiting factor is the AT:P attack requirement: the attacker must have a path to inject a valid HK request onto the command/telemetry network of a system running HS below v7.0.1 - in practice, access to the spacecraft bus or ground command link - which is not typically internet-exposed. No authentication, no user interaction, and no special product configuration beyond running an affected (pre-7.0.1) HS build is needed; there is no confidentiality or integrity exposure, only availability loss of the HS task.

The signals are consistent but modest in real-world reach. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scoring 8.2 reflects a network-reachable, unauthenticated, low-complexity trigger whose only impact is availability (VA:H) with no confidentiality or integrity loss (VC:N/VI:N) - a pure DoS. The AT:P (attack requirements present) metric signals a non-trivial precondition beyond a raw packet, likely the ability to deliver a valid Housekeeping Telemetry request onto the software bus, which typically requires access to the spacecraft command/telemetry network rather than the open internet. It is not in CISA KEV (no confirmed active exploitation) and no POC is published, so this is not an at-large mass-exploitation threat; however, for the specific mission-critical embedded context, loss of the health-monitoring task is operationally serious. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: real priority for cFS operators to patch, but low likelihood of opportunistic internet-scale exploitation given the specialized deployment surface.

An attacker with access to the spacecraft's command/telemetry network crafts and injects a Housekeeping Telemetry request to the HS application on the cFS Software Bus; the malformed handling dereferences a NULL pointer, the HS task segfaults, and health/watchdog monitoring is lost until the software is restarted. No public POC is known, and the AT:P requirement means the attacker must be able to deliver a valid HK request onto the bus rather than exploit from an arbitrary internet position.