CVE-2026-67972

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.

The SBN UDP interface in NASA cFS v7.0.1 allows an attacker to cause a Denial of Service (DoS) by sending a crafted SBN frame.

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.

A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.

An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.

In NASA cFS up to version 7.0.0 on 32-bit, an integer overflow vulnerability was identified in the CFE_TBL_ValidateCodecLoadSize function. The attack is difficult to execute but could lead to unexpected system behavior.

NASA cFS up to version 7.0.0 has a vulnerability in the function CFE_SB_TransmitMsg in file cfe_sb_priv.c of the CCSDS Header Size Handler component that can lead to memory corruption. The project was informed but has not responded.

In NASA cFS up to version 7.0.0, a heap-based buffer overflow exists in the function CFE_MSG_GetSize in file apps/to_lab/fsw/src/to_lab_passthru_encode.c. The attacker must have local network access. The project was informed but has not responded.