CVE-2026-82480CWE-191

CVE-2026-82480

High · published August 30, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CFE_SB_GetUserDataLength of the file src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c of the component cFE Software Bus. Performing a manipulation of the argument TotalMsgSize/HdrSize results in integer underflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
EPSS
0.00379 · 30.6th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-08-30T10:16Z
References (5)
https://vuldb.com/cve/CVE-2026-82480 · [email protected]https://vuldb.com/submit/888018 · [email protected]https://vuldb.com/vuln/397030 · [email protected]https://vuldb.com/vuln/397030/cti · [email protected]https://vuldb.com/submit/888018 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 30 AUG 05:30Z
    NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow
    cvelistv5