CVE-2026-105164

Received Received - Intake

Out-of-Bounds Read in NASA cFS up to 7.0.1

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description

A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-04

Generated

2026-10-05

AI Q&A

2026-10-05

EPSS Evaluated

N/A

NVD

CVE-2026-105164

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	cfs	to 7.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read flaw in NASA cFS up to version 7.0.1. It exists in the function CFE_FS_ParseInputFileNameEx within the file cfe/modules/fs/fsw/src/cfe_fs_api.c. The issue allows remote attackers to manipulate input to cause the program to read beyond allocated memory boundaries.

Detection Guidance

This vulnerability involves an out-of-bounds read in NASA cFS up to version 7.0.1, specifically in the CFE_FS_ParseInputFileNameEx function. Detection requires inspecting the cfe/modules/fs/fsw/src/cfe_fs_api.c file for the affected function and verifying if the version is 7.0.1 or earlier. No specific network or system commands are provided in the context to detect this issue.

Impact Analysis

The vulnerability could allow remote attackers to read sensitive data from memory or cause the application to crash. Since it is an out-of-bounds read, it may expose internal system information or lead to further exploitation depending on the system's configuration.

Compliance Impact

The vulnerability involves an out-of-bounds read in NASA cFS, which could potentially allow remote exploitation. This type of flaw may lead to unauthorized data access or disclosure, which could impact compliance with standards like GDPR (data protection) or HIPAA (health information privacy) if sensitive data is exposed.

Mitigation Strategies

Monitor for updates from NASA cFS and apply the pending pull request fix once accepted. Restrict access to the affected function CFE_FS_ParseInputFileNameEx until patched. Review system logs for unusual file parsing activities.

Hi! I’m here to help you understand CVE-2026-105164. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70