CVE-2026-82480

Name of the Vulnerable Software and Affected Versions NASA cFS versions prior to 7.0.2

Description A security flaw exists in the cFE Software Bus component within the CFE SB GetUserDataLength() function located in the src/cFS/cfe/modules/sb/fsw/src/cfe sb util.c file. A remote attacker can trigger an integer underflow by manipulating the TotalMsgSize/HdrSize argument. Integer underflow occurs when an arithmetic operation results in a value smaller than the minimum value the variable can hold, often causing it to wrap around to a very large positive number.

Recommendations As a temporary workaround, restrict access to the CFE SB GetUserDataLength() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.