Is CVE-2026-5474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5474 being exploited in the wild.

How severe is CVE-2026-5474?

Medium severity, with a CVSS score of 6.3, published 3 April 2026.

Which products and versions are affected?

Nasa Core Flight System up to 7.0.0.

Is there a fix for CVE-2026-5474?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5474 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-5474?

Check whether you run Nasa Core Flight System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5474: NASA cFS heap buffer overflow in CCSDS Packet Header Handler

CVE-2026-5474 · Severity: medium · CVSS 6.3 · Published 2026-04-03

NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions, contains a vulnerability in its telemetry output component. An attacker on the same local network can send a specially crafted message that causes the system to leak sensitive internal memory data over the network. This could result in the exposure of confidential mission data or system information, potentially aiding further attacks.

Technologies: Nasa Core Flight System. Vendors: Nasa.

Quick answers

Is CVE-2026-5474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5474 being exploited in the wild.
How severe is CVE-2026-5474?: Medium severity, with a CVSS score of 6.3, published 3 April 2026.
Which products and versions are affected?: Nasa Core Flight System up to 7.0.0.
Is there a fix for CVE-2026-5474?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5474 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-5474?: Check whether you run Nasa Core Flight System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (specifically a heap over-read) exists in NASA cFS up to version 7.0.0 within the CCSDS Packet Header Handler. The vulnerability is located in the `CFE_MSG_GetSize` function used by `apps/to_lab/fsw/src/to_lab_passthru_encode.c`. The root cause is that the `TO_LAB_EncodeOutputMessage` function trusts the length field provided in the CCSDS packet header without validating it against the actual Software Bus buffer allocation. An attacker with local network access can inject a crafted message with an inflated length field, causing `OS_SocketSendTo` to read and transmit adjacent heap memory over UDP. While reported to the vendor, no official patch has been confirmed at the time of this advisory.

Affected products

NASA cFS (core Flight System) up to 7.0.0

Timeline

2026-03-18: disclosed: Issue reported on GitHub by 0rbitingZer0
2026-04-03: advisory: VulDB and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.