CVE-2026-18064

Received Received - Intake

NULL Pointer Dereference in NASA cFS Health and Safety Application

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: ICS-CERT

Description

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-18064

EUVD

EUVD-2026-51331

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	core_flight_system	to 7.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the NASA core Flight System (cFS) Health and Safety (HS) application. It exists due to an incomplete fix for a previous vulnerability (CVE-2026-15352) and affects versions through 7.0.1. An attacker can trigger a specific command under certain conditions to crash the HS application, causing a denial-of-service and forcing a processor reset.

Detection Guidance

This vulnerability is specific to the NASA core Flight System (cFS) Health and Safety (HS) application. Detection requires checking the version of cFS installed on your system. If you are running versions through 7.0.1, the system may be vulnerable. No specific commands are provided in the context, but you should verify the installed version of cFS and inspect the HS application for crashes or processor resets under conditions triggering the affected command.

Impact Analysis

This vulnerability allows an attacker to cause the HS application to crash, leading to a denial-of-service condition. This can disrupt operations dependent on the cFS, potentially causing system downtime and requiring a processor reset to restore functionality.

Compliance Impact

This vulnerability causes a denial-of-service condition and processor reset, which could disrupt critical operations. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Immediate mitigation steps include updating the NASA core Flight System (cFS) to a version beyond 7.0.1 to address the incomplete fix for CVE-2026-15352. Additionally, restrict access to the affected command in the HS application to prevent unauthorized triggering. Monitor the HS application for crashes or processor resets as indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-18064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70