CVE-2026-67974

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.

The SBN UDP interface in NASA cFS v7.0.1 allows an attacker to cause a Denial of Service (DoS) by sending a crafted SBN frame.

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.

An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to control where received content and data is stored, possibly leading to an information disclosure.

In NASA cFS up to version 7.0.0 on 32-bit, an integer overflow vulnerability was identified in the CFE_TBL_ValidateCodecLoadSize function. The attack is difficult to execute but could lead to unexpected system behavior.

NASA cFS up to version 7.0.0 has a vulnerability in the function CFE_SB_TransmitMsg in file cfe_sb_priv.c of the CCSDS Header Size Handler component that can lead to memory corruption. The project was informed but has not responded.

In NASA cFS up to version 7.0.0, a heap-based buffer overflow exists in the function CFE_MSG_GetSize in file apps/to_lab/fsw/src/to_lab_passthru_encode.c. The attacker must have local network access. The project was informed but has not responded.