Core Flight System CVE-2026-5474

Q: What is the CVSS score of CVE-2026-5474?

CVE-2026-5474 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18807 MEDIUM

Buffer Overflow (CWE-119)

2026-04-03 cna@vuldb.com

GHSA-43rr-mfcw-532v

Buffer Overflow Core Flight System

5.3

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 03, 2026 - 17:22 euvd

EUVD-2026-18807

Analysis Generated

Apr 03, 2026 - 17:22 vuln.today

CVE Published

Apr 03, 2026 - 17:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local network to execute the attack. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Heap-based buffer overflow in NASA cFS up to version 7.0.0 exists in the CFE_MSG_GetSize function within the CCSDS Packet Header Handler component (apps/to_lab/fsw/src/to_lab_passthru_encode.c), allowing attackers on the local network to cause memory corruption with limited confidentiality, integrity, and availability impact. The vulnerability requires network adjacency but no authentication or user interaction; no public exploit code has been identified, and the project has not yet released a patch despite early notification through GitHub issue tracking.

Technical ContextAI

NASA cFS (Core Flight System) is a reusable, open-source flight software architecture used in space missions. The vulnerability resides in the CCSDS (Consultative Committee for Space Data Systems) Packet Header Handler, specifically in message size calculation logic. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates that the CFE_MSG_GetSize function fails to properly validate input parameters or calculate buffer boundaries before writing to heap memory, enabling an attacker to write beyond allocated buffer limits. The affected component processes CCSDS telemetry packets, a standard format for spacecraft communication, making this a critical area for aerospace systems.

RemediationAI

Upgrade NASA cFS to a patched version beyond 7.0.0 once available from the project. At the time of this analysis, no vendor-released patch version has been confirmed, though the issue was reported early via GitHub. Users should monitor https://github.com/nasa/cFS/issues/952 and the official cFS release pages for patch availability. As an interim measure, operators should restrict network access to systems running cFS to trusted, authenticated interfaces only, segment spacecraft command networks from untrusted local networks, and implement input validation for CCSDS packet headers at the network boundary. Organizations operating cFS-based missions should contact NASA directly through appropriate channels to request priority patch development and interim mitigation guidance.