Integer overflow in Nasa Cfs
CVE-2026-82480
A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (30.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Nasa Cfs — versions 7.0.0, 7.0.1
Weakness classification (CWE)
References
- vuldb.com/vuln/397030 (technical-description, vdb-entry)
- vuldb.com/vuln/397030/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-82480 (third-party-advisory)
- vuldb.com/submit/888018 (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82480?
- CVE-2026-82480 is a high-severity vulnerability in Nasa Cfs, classified under CWE-189. CVSS score: 7.4/10. Published 2026-08-30.
- How severe is CVE-2026-82480?
- High severity. CVSS v3 base score is 7.4 out of 10.