A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/nasa/cFS/pull/984 issue-tracking, patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.1 · nasaNVD modified 2026-10-25 06:42
Affected (CPE criteria) 1
cpe:2.3:a:nasa:cfs:*:*:*:*:*:*:*:*
References 7
- https://vuldb.com/vuln/413396 vdb-entry, technical-description
- https://vuldb.com/vuln/413396/cti signature, permissions-required
- https://vuldb.com/cve/CVE-2026-105164 third-party-advisory
- https://vuldb.com/submit/969930 third-party-advisory
- https://github.com/nasa/cFS/issues/893 issue-tracking
- https://github.com/nasa/cFS/pull/984 issue-tracking, patch
- https://github.com/nasa/cFS/ product