Executive brief
A vulnerability exists in NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions. On 32-bit flight processors, a flaw in how the system validates table data updates could allow an authorized user to bypass safety checks. This could lead to memory corruption, potentially causing system instability or unauthorized modification of flight software operations.
Technical details
An integer overflow vulnerability exists in the `CFE_TBL_ValidateCodecLoadSize` function within `cfe_tbl_passthru_codec.c`. The root cause is the use of 32-bit unsigned integer arithmetic when calculating `ProjectedSize = Offset + NumBytes`. On 32-bit targets (such as LEON3 or RAD750 processors), a large `Offset` combined with a specific `NumBytes` value can cause the sum to wrap around, bypassing the `ProjectedSize > ActualSize` bounds check. An attacker with the authority to issue ground commands can craft a malicious table load file to trigger this overflow, resulting in an out-of-bounds memory write during the subsequent `memcpy` in `CFE_TBL_LoadContentFromFile`. This vulnerability specifically impacts 32-bit platforms where pointer arithmetic wraps at 2^32.
Affected products
- NASA core Flight System (cFS) up to 7.0.0
Timeline
- 2026-03-18: disclosed: Issue reported on GitHub repository
- 2026-04-03: advisory: VulDB and NVD publication