CVE-2026-5474

Katalog CVE

CVSS 8.8 · High EPSS 0,61%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada nasa core flight system. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local network to execute the attack. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/submit/781950 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/355078 advisory pihak ketiga · vdb entry
• https://github.com/nasa/cFS/ product
• https://github.com/nasa/cFS/issues/952 issue tracking
• https://vuldb.com/vuln/355078/cti permissions required · vdb entry