What’s Vulnerable › Vulnerabilities

CVE-2026-82480: NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-30 · updated 2026-09-01
• Weakness: CWE-189

Description

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• NASA cFS: 7.0.0, 7.0.1

References

• https://vuldb.com/cve/CVE-2026-82480
• https://vuldb.com/submit/888018
• https://vuldb.com/vuln/397030
• https://vuldb.com/vuln/397030/cti
• https://vuldb.com/submit/888018

Get alerted when CVE-2026-82480 or the next vulnerability affects your stack