Executive brief
NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions, contains a memory handling vulnerability. An attacker or a compromised application on the same system could exploit this to read sensitive data from other parts of the system's memory. This could lead to the exposure of confidential mission data or system information, potentially impacting the security and integrity of flight operations.
Technical details
A buffer over-read vulnerability exists in the NASA cFS Software Bus (SB) component, specifically within the CFE_SB_TransmitMsg function in cfe_sb_priv.c. The root cause is a lack of source buffer validation; the function trusts the length field within the CCSDS message header to determine how many bytes to copy via memcpy. An attacker with the ability to send messages can craft a header with a length field larger than the actual source buffer, causing the system to read and transmit up to 32,768 bytes of adjacent memory to all message subscribers. This is particularly critical on flat-memory RTOS deployments (like VxWorks or RTEMS) where it can lead to cross-application information disclosure. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- NASA core Flight System (cFS) up to 7.0.0
Timeline
- 2026-03-18: disclosed: Issue reported to NASA cFS GitHub repository
- 2026-04-03: advisory: Initial VulDB and NVD publication