CVE-2026-5475 Details

A memory corruption vulnerability has been identified in NASA's Core Flight System (cFS) version 7.0.0. The issue arises in the CFE_SB_TransmitMsg function within the cfe_sb_priv.c file, specifically related to the CCSDS Header Size Handler component. The vulnerability occurs because the function reads the message size from the CCSDS header and uses it as the length for memcpy operations, without validating that the caller's buffer contains the claimed number of bytes. This oversight allows for buffer over-read vulnerabilities, where data from adjacent memory is incorrectly accessed and potentially leaked to subscribers of the message ID. On certain real-time operating systems, this could enable cross-application information disclosure.