CVE-2026-67974 Details

A denial-of-service vulnerability has been identified in the Software Bus Network (SBN) application of NASA's Core Flight System (cFS) version 7.0.1. The issue arises from a parser boundary flaw in how the application handles peer subscription messages. This flaw allows attackers to send crafted packets that the parser accepts, even if they exceed the actual payload limit, leading to unintended state changes. The vulnerability is present in the SBN application's subscription management functions, which fail to properly validate the size of incoming messages before processing them.

It is recommended to update the SBN message parsing functions to include proper boundary checks and validation of the received message sizes before processing. This should involve rejecting messages that do not conform to expected size requirements and addressing any unpacking errors as critical failures.