CVE-2026-105164 in cFS
Summary
by MITRE • 10/05/2026
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in NASA's core Flight System (cFS), specifically affecting versions up to 7.0.1, represents a critical security flaw within the file system abstraction layer. This defect resides in the CFE_FS_ParseInputFileNameEx function located in the source file cfe/modules/fs/fsw/src/cfe_fs_api.c. The core technical issue is an out-of-bounds read condition that occurs when the function processes input filenames under specific malformed or unexpected conditions. In embedded and aerospace software environments, such as those managed by NASA's cFS framework, robust handling of file paths is essential for system stability and security. When this parsing routine fails to properly validate boundary constraints during string manipulation, it allows the application to read memory locations beyond the allocated buffer limits. This type of error typically stems from insufficient checks on input length or improper pointer arithmetic when iterating through character arrays representing file names.
From a technical perspective, an out-of-bounds read is classified under CWE-125 in the Common Weakness Enumeration standard. While often considered less severe than write vulnerabilities because it does not directly allow arbitrary code execution via memory corruption, it can still lead to significant security compromises. In this context, the ability to read unintended memory contents may expose sensitive internal state information, configuration data, or cryptographic keys stored adjacent to the buffer in memory. Furthermore, if the application logic relies on the return value of this function for control flow decisions based on partially corrupted or misinterpreted string data, it could lead to logical errors that further destabilize the system. The presence of remote exploitation potential indicates that an attacker who can interact with the file system interface over a network connection may trigger this condition remotely, making it particularly dangerous in connected aerospace or ground station environments where cFS components are exposed to external inputs.
The operational impact of this vulnerability extends beyond simple data leakage. In critical infrastructure and space mission systems, reliability is paramount. An out-of-bounds read can cause the application to crash if the accessed memory page is unmapped, leading to a denial of service condition that disrupts ongoing operations or scientific experiments. Even if the process does not terminate immediately, the corruption of subsequent logic due to reading invalid data can result in unpredictable behavior, potentially affecting navigation systems, telemetry processing, or command execution sequences. The fact that remote exploitation is possible elevates the severity significantly, as it removes the requirement for physical access or local user privileges, allowing potential adversaries to target the system from a network position without authentication if other security controls are not strictly enforced.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution involves applying the pending pull request that corrects the boundary checks within CFE_FS_ParseInputFileNameEx. This patch likely introduces rigorous validation of input string lengths before processing ensures that no read operations exceed allocated memory boundaries. Until such a fix is integrated into production builds, operators should implement strict input filtering at network ingress points to reject malformed file path requests. Additionally, enabling Address Sanitizer (ASan) or similar runtime error detection tools during development and testing phases can help identify similar issues in other parts of the codebase before deployment. From an architectural standpoint, adopting secure coding standards such as MISRA C or CERT C guidelines for embedded systems will reduce the likelihood of future buffer handling errors. Regular security audits focusing on file system APIs are also recommended to ensure that all external inputs are treated as untrusted and validated thoroughly against expected formats and lengths.