Executive brief
NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions, contains a vulnerability in its telemetry output component. An attacker on the same local network can send a specially crafted message that causes the system to leak sensitive internal memory data over the network. This could result in the exposure of confidential mission data or system information, potentially aiding further attacks.
Technical details
A heap-based buffer overflow (specifically a heap over-read) exists in NASA cFS up to version 7.0.0 within the CCSDS Packet Header Handler. The vulnerability is located in the `CFE_MSG_GetSize` function used by `apps/to_lab/fsw/src/to_lab_passthru_encode.c`. The root cause is that the `TO_LAB_EncodeOutputMessage` function trusts the length field provided in the CCSDS packet header without validating it against the actual Software Bus buffer allocation. An attacker with local network access can inject a crafted message with an inflated length field, causing `OS_SocketSendTo` to read and transmit adjacent heap memory over UDP. While reported to the vendor, no official patch has been confirmed at the time of this advisory.
Affected products
- NASA cFS (core Flight System) up to 7.0.0
Timeline
- 2026-03-18: disclosed: Issue reported on GitHub by 0rbitingZer0
- 2026-04-03: advisory: VulDB and NVD publication