Vulnerability · Published Aug 30, 2026 · Assigned by VulDB

CVE-2026-82479NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow

Medium 6.3

In plain English

A medium-severity buffer overflow in cFS from NASA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file modules/protocol/tcp/fsw/src/sbn_tcp_if.c of the component SBN TCP Module. Such manipulation of the argument MsgSz leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
NASA	cFS	7.0.07.0.1

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-397029 | NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow vdb-entry, technical-description
VDB-397029 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-82479 | CVE Analysis and Report third-party-advisory
Submit #888017 | NASA cFS 7.0.1 Memory Corruption third-party-advisory