CVE-2026-82480: Integer Underflow in NASA cFS

This vulnerability involves an integer underflow in the CFE_SB_GetUserDataLength function of the cFE Software Bus component in NASA cFS up to version 7.0.1. Specifically, manipulating the TotalMsgSize/HdrSize argument leads to an integer underflow condition. The vulnerability is remotely exploitable, potentially allowing an attacker to cause unexpected behavior in the software bus message handling. The vendor has not provided any advisory or patch at this time.

The integer underflow may cause incorrect calculation of message data length, potentially leading to memory corruption or other unintended behavior in the cFE Software Bus. This could affect the reliability or security of systems using NASA cFS. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate impact with network attack vector and low complexity. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official NASA cFS channels for updates. Until a patch is available, cautious use and additional validation of message sizes may help mitigate risk.