# CVE-2026-5475: NASA cFS memory corruption in CCSDS Header Size Handler

Source: https://junglewise.ai/threats/cve-2026-5475-nasa-cfs-memory-corruption-in-ccsds-header-size-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5475 · Severity: medium · CVSS 5.5 · Published 2026-04-03

NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions, contains a memory handling vulnerability. An attacker or a compromised application on the same system could exploit this to read sensitive data from other parts of the system's memory. This could lead to the exposure of confidential mission data or system information, potentially impacting the security and integrity of flight operations.

Technologies: [Nasa Core Flight System](https://junglewise.ai/threats/technologies/core-flight-system). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-5475 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5475 being exploited in the wild.

**How severe is CVE-2026-5475?** Medium severity, with a CVSS score of 5.5, published 3 April 2026.

**Which products and versions are affected?** Nasa Core Flight System up to 7.0.0.

**Is there a fix for CVE-2026-5475?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5475 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-5475?** Check whether you run Nasa Core Flight System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer over-read vulnerability exists in the NASA cFS Software Bus (SB) component, specifically within the CFE_SB_TransmitMsg function in cfe_sb_priv.c. The root cause is a lack of source buffer validation; the function trusts the length field within the CCSDS message header to determine how many bytes to copy via memcpy. An attacker with the ability to send messages can craft a header with a length field larger than the actual source buffer, causing the system to read and transmit up to 32,768 bytes of adjacent memory to all message subscribers. This is particularly critical on flat-memory RTOS deployments (like VxWorks or RTEMS) where it can lead to cross-application information disclosure. As of the advisory date, the project has been notified but a formal patch has not been confirmed.

## Affected products

- NASA core Flight System (cFS) up to 7.0.0

## Timeline

- 2026-03-18: disclosed: Issue reported to NASA cFS GitHub repository
- 2026-04-03: advisory: Initial VulDB and NVD publication

## References

- [https://github.com/nasa/cFS/](https://github.com/nasa/cFS/)
- [https://github.com/nasa/cFS/issues/953](https://github.com/nasa/cFS/issues/953)
- [https://vuldb.com/submit/781951](https://vuldb.com/submit/781951)
- [https://vuldb.com/vuln/355079](https://vuldb.com/vuln/355079)
- [https://vuldb.com/vuln/355079/cti](https://vuldb.com/vuln/355079/cti)

## Related threats

- [NASA cFS integer overflow in CFE_TBL_ValidateCodecLoadSize](https://junglewise.ai/threats/cve-2026-5476-nasa-cfs-integer-overflow-in-cfe-tbl-validatecodecloadsize)
- [NASA cFS heap buffer overflow in CCSDS Packet Header Handler](https://junglewise.ai/threats/cve-2026-5474-nasa-cfs-heap-buffer-overflow-in-ccsds-packet-header-handler)
- [NASA cFS deserialization in Ground System Pickle Module](https://junglewise.ai/threats/cve-2026-5473-nasa-cfs-deserialization-in-ground-system-pickle-module)