CVE-2026-67974

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.

A flaw has been found in NASA cFS up to 7.0.1 in the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. The manipulation causes an out-of-bounds read, and remote exploitation is possible. A pull request to fix this issue awaits acceptance.

A vulnerability was discovered in NASA cFS up to 7.0.1, affecting the CFE_SB_GetUserDataLength function in cfe_sb_util.c of the cFE Software Bus component. Manipulating TotalMsgSize/HdrSize results in integer underflow. The attack can be initiated remotely, and the vendor did not respond.

A vulnerability was identified in NASA cFS up to 7.0.1, affecting the OS_read function in sbn_tcp_if.c of the SBN TCP Module. Manipulating the MsgSz argument leads to buffer overflow. The attack must be carried out from within the local network. The vendor did not respond.

The SBN UDP interface in NASA cFS v7.0.1 allows an attacker to cause a Denial of Service (DoS) by sending a crafted SBN frame.

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.

An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to control where received content and data is stored, possibly leading to an information disclosure.