CVE-2026-82480: Nasa Cfs

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• Nasa Cfs: version 7.0.0 only; version 7.0.1 only

Published 2026-08-30. Last modified 2026-09-01.