Integer Underflow in NASA cFS Software Bus Affects Remote Operations
CVE-2026-82480

5.3MEDIUM

Key Information:

Vendor

Nasa

Status
Cfs
Vendor
CVE Published:
30 August 2026

What is CVE-2026-82480?

A security flaw has been identified in the cFS Software Bus of NASA, specifically in the function CFE_SB_GetUserDataLength within the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c. This vulnerability is caused by improper handling of arguments, leading to integer underflow when manipulating TotalMsgSize or HdrSize. Attackers can exploit this flaw remotely, potentially compromising the security of systems utilizing this software. Despite early disclosure to the vendor, there has been no response to address the issue.

Affected Version(s)

cFS 7.0.0

cFS 7.0.1

References

https://vuldb.com/vuln/397030
vdb-entrytechnical-description
https://vuldb.com/vuln/397030/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-82480
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

juntheworld (VulDB User)
VulDB CNA Team
.