NASA cFS CVE-2026-82480

Exploitation requires low-level authenticated access to the cFS Software Bus - specifically, the ability to submit crafted messages with attacker-controlled TotalMsgSize and HdrSize header field values to the CFE_SB_GetUserDataLength function over a network connection. The vulnerability is constrained to cFS deployments at version 7.0.1 or earlier. Unauthenticated or anonymous network attackers cannot trigger the flaw without first obtaining Software Bus client access credentials or a privileged bus context (PR:L per CVSS 4.0 vector). Exploitation impact is bounded to Low confidentiality, integrity, and availability - no remote code execution or full system compromise has been demonstrated or claimed. Deployments in fully air-gapped or internally isolated network environments face meaningfully reduced exposure despite the network attack vector.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a constrained threat profile: network-reachable but requiring low-privilege authenticated access (PR:L), with impact capped at Low across all CIA dimensions for both the vulnerable system and subsequent bus consumers. No KEV listing exists, no public proof-of-concept has been identified, and EPSS data is absent - collectively suggesting that exploitation has not attracted broad criminal or nation-state tooling at this time. The real-world risk is further bounded by cFS's specialized deployment footprint: this is not enterprise IT software but aerospace and embedded-systems infrastructure, where operator networks are often isolated or air-gapped. That said, the absence of a vendor response and any fix means the vulnerability window is indefinite, and the cross-system scope (SC/SI/SA:L in CVSS 4.0) is notable for mission-critical platforms where Software Bus integrity is foundational to payload and command routing. Organizations integrating cFS into ground-support or mission-operations networks with broader connectivity should treat this as higher priority than the raw score implies, while those running fully air-gapped flight software stacks face materially lower risk.

An attacker with low-privilege access to the cFS Software Bus network interface - for example, a compromised ground-support workstation or a malicious internal bus client - crafts a message in which TotalMsgSize is smaller than HdrSize, causing CFE_SB_GetUserDataLength to compute a massively inflated user-data length via integer underflow. The Software Bus then uses this incorrect length to read beyond the message buffer boundary, potentially leaking adjacent memory contents (e.g., telemetry buffers, command data) or corrupting message routing metadata. No public proof-of-concept code is known at this time.