CVE-2026-5476
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In NASA cFS up to version 7.0.0 on 32-bit, an integer overflow vulnerability was identified in the CFE_TBL_ValidateCodecLoadSize function. The attack is difficult to execute but could lead to unexpected system behavior.
Risk Assessment
The risk involves potential disruption of the flight system, which could impact mission safety.
Recommendation
It is recommended to apply the planned patch in the upcoming project version and monitor for updates.
Original NVD description (English source)
A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to be difficult. A fix is planned for the upcoming version milestone of the project.