Heap-Based Buffer Overflow in NASA cFS Product

CVE-2026-5474

What is CVE-2026-5474?

The vulnerability in NASA's cFS is associated with the CFE_MSG_GetSize function within the CCSDS Packet Header Handler component found in to_lab_passthru_encode.c. This issue could lead to a heap-based buffer overflow, allowing an attacker with local network access to manipulate data. Although the organization has been notified of the vulnerability through an issue report, no response has been issued. This situation raises concerns about the security posture of the affected software, particularly in environments where cFS is deployed.

References