# CVE-2026-5476: NASA cFS integer overflow in CFE_TBL_ValidateCodecLoadSize

Source: https://junglewise.ai/threats/cve-2026-5476-nasa-cfs-integer-overflow-in-cfe-tbl-validatecodecloadsize  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5476 · Severity: medium · CVSS 4.6 · Published 2026-04-03

A vulnerability exists in NASA's core Flight System (cFS), a software framework used in satellite and spacecraft missions. On 32-bit flight processors, a flaw in how the system validates table data updates could allow an authorized user to bypass safety checks. This could lead to memory corruption, potentially causing system instability or unauthorized modification of flight software operations.

Technologies: [Nasa Core Flight System](https://junglewise.ai/threats/technologies/core-flight-system). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-5476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5476 being exploited in the wild.

**How severe is CVE-2026-5476?** Medium severity, with a CVSS score of 4.6, published 3 April 2026.

**Which products and versions are affected?** Nasa Core Flight System up to 7.0.0.

**Is there a fix for CVE-2026-5476?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5476 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-5476?** Check whether you run Nasa Core Flight System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the `CFE_TBL_ValidateCodecLoadSize` function within `cfe_tbl_passthru_codec.c`. The root cause is the use of 32-bit unsigned integer arithmetic when calculating `ProjectedSize = Offset + NumBytes`. On 32-bit targets (such as LEON3 or RAD750 processors), a large `Offset` combined with a specific `NumBytes` value can cause the sum to wrap around, bypassing the `ProjectedSize > ActualSize` bounds check. An attacker with the authority to issue ground commands can craft a malicious table load file to trigger this overflow, resulting in an out-of-bounds memory write during the subsequent `memcpy` in `CFE_TBL_LoadContentFromFile`. This vulnerability specifically impacts 32-bit platforms where pointer arithmetic wraps at 2^32.

## Affected products

- NASA core Flight System (cFS) up to 7.0.0

## Timeline

- 2026-03-18: disclosed: Issue reported on GitHub repository
- 2026-04-03: advisory: VulDB and NVD publication

## References

- [https://github.com/nasa/cFS/](https://github.com/nasa/cFS/)
- [https://github.com/nasa/cFS/issues/954](https://github.com/nasa/cFS/issues/954)
- [https://vuldb.com/submit/781971](https://vuldb.com/submit/781971)
- [https://vuldb.com/vuln/355080](https://vuldb.com/vuln/355080)
- [https://vuldb.com/vuln/355080/cti](https://vuldb.com/vuln/355080/cti)

## Related threats

- [NASA cFS memory corruption in CCSDS Header Size Handler](https://junglewise.ai/threats/cve-2026-5475-nasa-cfs-memory-corruption-in-ccsds-header-size-handler)
- [NASA cFS heap buffer overflow in CCSDS Packet Header Handler](https://junglewise.ai/threats/cve-2026-5474-nasa-cfs-heap-buffer-overflow-in-ccsds-packet-header-handler)
- [NASA cFS deserialization in Ground System Pickle Module](https://junglewise.ai/threats/cve-2026-5473-nasa-cfs-deserialization-in-ground-system-pickle-module)