NASA cFS CVE-2026-18064

Exploitation requires the attacker to deliver the specific Health and Safety application command that reaches the NULL-pointer code path AND for the HS application to be in the 'specific conditions' state noted in the description (reflected as AT:P / Attack Requirements: Present in the CVSS 4.0 vector), meaning it is not a guaranteed one-shot against every default runtime state. Per CVSS the vector is AV:N/PR:N/UI:N - no authentication or user interaction is modeled - so the practical limiting factors are: reachability of the cFS Software Bus command interface (in real missions typically the internal command bus or authenticated ground link rather than the open internet), the ability to craft and route that particular HS command, and the target being on an affected build at or below version 7.0.1. Impact is limited to availability (VA:H): a crash, DoS, and processor reset, with no confidentiality or integrity effect.

The supplied CVSS 4.0 base score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact confined to availability of the vulnerable system (VA:H; VC:N/VI:N). The most important signal is AT:P (Attack Requirements: Present) combined with the description's 'under specific conditions' - exploitation is not turnkey against an arbitrary default state and depends on the HS application being in, or being driven into, a particular condition, which meaningfully lowers real-world likelihood relative to the network-reachable, unauthenticated PR:N/UI:N metrics. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation; EPSS and SSVC decision data were not provided in the input and cannot be cited. Note a plausible tension worth verifying: PR:N/AV:N implies remote unauthenticated command injection, but in real cFS deployments the Software Bus command interface is typically reachable only across a spacecraft's internal command path or ground link rather than the open internet - verify the actual command-ingress exposure for a given mission before treating this as broadly network-exploitable. Net: a genuine availability risk to a safety-critical component, but the 'specific conditions' requirement and absence of exploit code make it a measured priority rather than an emergency for most operators.

An attacker with access to the spacecraft's command path - for example a compromised ground station element or an entity able to inject onto the internal command bus - sends the specific crafted HS command while the application is in the vulnerable state, causing a NULL pointer dereference that crashes the Health and Safety app and triggers a processor reset, disrupting fault monitoring. No public exploit is identified at time of analysis, and the low attack complexity is offset by the AT:P requirement that particular conditions be met for the command to reach the vulnerable path.