CVE-2026-5475
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_priv.c of the component CCSDS Header Size Handler. Executing a manipulation can lead to memory corruption. The project was informed of the problem early through an issue report but has not responded yet.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA memory corruption vulnerability exists in NASA cFS Software Bus (SB) message transmission function CFE_SB_TransmitMsg within cfe_sb_priv.c. The issue stems from improper handling of CCSDS header sizes in the CCSDS Header Size Handler component, allowing manipulation during message transmission that can corrupt memory. The vulnerability affects all versions up to 7.0.0 and has not yet been addressed by the project.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data<= 7.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Adjacent
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify if NASA cFS is deployedLocate the core Flight System installation directories and verify the presence of cFS components such as the Software Bus (SB) module.Affected if NASA cFS software is present in the environment.
-
Determine cFS versionInspect version information in the cFS installation (typically found in version files, build manifests, or the cFE core module headers). Compare the installed version to the affected range of <= 7.0.0.Affected if The installed cFS version is 7.0.0 or lower.
-
Verify Software Bus module is in useCheck if the cFE Software Bus (SB) component is compiled and active in the deployment. Look for SB configuration and initialization code.Affected if The SB module is enabled and processing message transmissions.
-
Inspect CCSDS message handling in CFE_SB_TransmitMsgExamine the cfe_sb_priv.c source code or binary for the CFE_SB_TransmitMsg function to determine if it processes CCSDS-formatted messages with header size fields.Affected if The function handles CCSDS messages where header size values are used without proper bounds validation.
-
Check for CCSDS header size validationReview message processing logic around CFE_SB_TransmitMsg for any validation or bounds checking on CCSDS header size fields before memory operations.Affected if No bounds checking exists on CCSDS header size values prior to memory allocation or copying operations.
You are affected if NASA cFS version 7.0.0 or lower is deployed and the Software Bus module processes CCSDS messages through CFE_SB_TransmitMsg without validating header size bounds.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUntil an official patch is released, restrict access to the SB message transmission interfaces and implement input validation checks on CCSDS header size values before processing. Consider adding bounds checking in CFE_SB_TransmitMsg to validate header size fields against expected ranges.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA6.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,776.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-5475 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-5475 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data